FISMA and the Federal Risk Management Framework
Table of Contents
FISMA is federal information security law, not a single certification checklist. The Federal Information Security Management Act of 2002 required agency-wide security programs. The Federal Information Security Modernization Act of 2014 amended that law and strengthened continuous monitoring and incident reporting. NIST explains this history in its FISMA background .
Return to the Cybersecurity Career Playbook .
Use a Risk-Based Process
Federal agencies and systems operated on their behalf need security protections proportionate to risk. NIST’s Risk Management Framework gives a seven-step process: Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor. The authorizing official accepts residual risk for a defined system and period. Authorization is a decision supported by evidence, not a claim that the system is perfectly secure.
| Step | Learner question | Example record |
|---|---|---|
| Prepare | Who owns the system and risk decisions? | Roles and boundary |
| Categorize | What harm follows loss of confidentiality, integrity, or availability? | Impact rationale |
| Select and implement | Which controls address that risk? | Control plan and implementation record |
| Assess | Do the controls operate as intended? | Test results and findings |
| Authorize | Who accepts the remaining risk? | Dated decision and conditions |
| Monitor | What changed after authorization? | New findings, remediation, and status |
The older term certification and accreditation appears in historical material. Use current control assessment, authorization, and continuous monitoring language when describing the live process. Contract requirements and agency-specific policy decide which controls and evidence apply to a real system.
Practice on a Synthetic Service
Describe a fictional internal ticket system. State its boundary, owner, data type, and one confidentiality or availability risk. Choose one control, a test that could fail, and evidence to give the authorizing official. Then change a system component in the scenario. Explain what the monitor step should detect and who reviews the new risk. This exercise teaches the decision chain without claiming a real authorization.
Related Posts
