[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Compliance and Regulations](/category/compliance-and-regulations) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [What is FISMA? FISMA Compliance Requirements](/blog/fisma) Publish date December 9, 2025 {x} minute read # What is FISMA? FISMA Compliance Requirements [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/complete-guide-to-third-party-risk-management) [Free trial](/demo) Written by [Abi Tyas Tunggal](/team/abi-tyas-tunggal) Writer and Senior Product Manager at UpGuard. Abi's work has influenced leaders across cybersecurity, technology, and financial services. Reviewed by [Cindy Ruan](/team/cindy-ruan) Lead GRC specialist Cindy combines degrees in Computer Science and Law with expertise in GRC, and she has presented her insights at the Australian Cyber Conference. Table of contents eBook A Complete Guide to Third-Party Risk Management Free resource ### A Complete Guide to Third-Party Risk Management Learn how to protect your business with an effective cybersecurity program. [Download now](/resources/complete-guide-to-third-party-risk-management) The Federal Information Security Management Act of 2002 (FISMA) is a United States federal law that defines a comprehensive framework to protect government information, operations, and assets against natural and manmade threats. FISMA was enacted as part of the E-Government Act of 2002 and is one of the most important regulations for federal [data security](https://www.upguard.com/blog/data-security) standards and guidelines. The act requires each federal agency in the US government to develop, document, and implement an agency-wide information security program to protect sensitive data and information systems that support the operations and assets of the agency, including those provided or managed by another agency, [third-party vendor](https://www.upguard.com/blog/third-party-vendor), or service provider. ## What is the Purpose of FISMA? FISMA assigns specific responsibilities to federal agencies, the National Institute of Standards and Technology (NIST), and the Office of Management and Budget (OMB) to strengthen information security systems. In particular, FISMA requires agency program officials, chief information officers (CIOs), and inspectors general (IGs) to implement [information security policies](https://www.upguard.com/blog/information-security-policy) and controls to cost-effectively reduce [information technology security risk](https://www.upguard.com/blog/cybersecurity-risk) to an acceptable level. Once implemented, they must conduct an annual review of the agency's information security program and report the results to the Office of Management and Budget (OMB). The OMB then uses this data to assist in its oversight responsibilities and to prepare an annual report to Congress on agency compliance with FISMA. FISMA's scope has since increased to include state agencies administering federal programs like Medicare and any [third-party vendors](https://www.upguard.com/blog/third-party-vendor) involved in a contractual agreement with the government. In 2010, the Office of Management and Budget (OMB) released guidelines requiring agencies to provide real-time system information to FISMA auditors, enabling continuous monitoring of FISMA-regulated information systems. ### FISMA 2014 While FISMA was replaced by the Federal Information Security Modernization Act of 2014 (FISMA 2014), it brought attention to the need for [cybersecurity](https://www.upguard.com/blog/cyber-security) within the federal government by emphasizing the need for "a risk-based policy for cost-effective security."   FISMA 2014: * Codifies the Department of Homeland Security's (DHS) authority to administer the implementation of information security policies for non-national security federal Executive Branch systems, including providing technical assistance and deployment * Amends and clarifies the Office of Management and Budget's (OMB) oversight authority over federal agency information security * Requires OMB to amend or revise OMB A-130 to eliminate inefficient and wasteful reporting The updated [A-130](https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/OMB/circulars/a130/a130revised.pdf) emphasizes managing sensitive information over its lifecycle, representing a shift from viewing security and privacy requirements as compliance exercises to crucial elements of comprehensive, strategic, and continuous risk-based programs at federal agencies.   ### How Was FISMA Implemented? The National Institute of Standards and Technology (NIST) developed standards, guidelines, and other resources to provide information security for all federal agency operations and assets in the FISMA Implementation Project launched in January 2003, excluding national security systems. Part of NIST's role is to work closely with federal agencies to improve their understanding and implementation of FISMA and publish standards and guidelines, like the [NIST Cybersecurity Framework](https://www.upguard.com/blog/nist-cybersecurity-framework), which provides the foundation for strong [information security](https://www.upguard.com/blog/information-security) programs. ## What are the FISMA Compliance Requirements? FISMA defines a framework for managing information security that must be followed by all information systems used or operated by a U.S. federal government agency in the executive or legislative branches and by third-party vendors who work on behalf of a federal agency in those branches. The framework is further defined by the National Institute of Standards and Technology (NIST), which has published standards and guidelines such as [FIPS 199 Standards for Security Categorization of Federal Information and Information Systems](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.199.pdf), [FIPS 200 Minimum Security Requirements for Federal Information and Information Systems](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.200.pdf) and the [NIST 800 series](https://csrc.nist.gov/publications/sp800). There are seven main FISMA requirements: ### 1. Information System Inventory FISMA requires agencies and [third-party vendors](https://www.upguard.com/blog/third-party-vendor) to maintain an inventory of their information systems and an identification of any interfaces between each system and other systems or networks, including those not operated by or under the control of the agency. [NIST SP 800-18, Revision 1, Guide for Developing Security Plans for Federal Information Systems](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-18r1.pdf), provides guidance on determining how to group information systems and their boundaries. ### 2. Risk Categorization All [sensitive information](https://www.upguard.com/blog/sensitive-data) and information systems are categorized based on their required information security according to a range of risk levels. [FIPS 199](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.199.pdf) and [NIST SP 800-60 Guide for Mapping Types of Information and Information Systems to Security Categories](https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=152106) provide categorization guidelines. The key thing to understand about FISMA's [risk assessment methodology](https://www.upguard.com/blog/risk-assessment-methodology) is that it uses the high water mark for its impact rating. This means if a system scores low risk for [confidentiality and integrity but high risk for availability](https://www.upguard.com/blog/cia-triad), the impact level would be high risk. ### 3. Security Controls FISMA requires federal information systems to meet minimum security requirements defined in [FIPS 200](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.200.pdf). [NIST SP 800-53 Recommended Security Controls for Federal Information Systems](https://www.upguard.com/blog/nist-sp-800-53) outlines appropriate security controls and assurance requirements. Agencies are not required to implement every control, only those they deem necessary. Once controls are selected and minimum security requirements satisfied, agencies must document selected controls in their system security plan. ### 4. Risk Assessments The combination of [FIPS 200](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.200.pdf) and [NIST SP 800-53](https://www.upguard.com/blog/nist-sp-800-53) forms the foundational level of all federal agencies' risk management frameworks. A [cybersecurity risk assessment](https://www.upguard.com/blog/how-to-perform-a-cybersecurity-risk-assessment) determines if the current security controls are sufficient and if any additional controls are needed. Any risk assessment starts by identifying potential [cyber threats](https://www.upguard.com/blog/cyber-threat), [cyberattacks](https://www.upguard.com/blog/cyber-attack), [vulnerabilities](https://www.upguard.com/blog/vulnerability), [exploits](https://www.upguard.com/blog/exploit), and other [common attack vectors](https://www.upguard.com/blog/attack-vector), then map to controls designed to mitigate them. Risk is determined by calculating the likelihood and impact of a given security incident, considering existing controls. The end result is a risk assessment with calculated risks for all events and information about whether the risk is to be accepted or mitigated. ### 5. System Security Plan (SSP) [NIST SP-800-18](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-18r1.pdf) introduced the concept of a system security plan, a living document requiring periodic review, modification, plans of action, and milestones for implementing security controls. Procedures should be developed and outlined to review the plan, keep it current, and follow the progress on any planned security controls. The system security plan is a major input into the security certification and accreditation process. During the process, the system security plan is analyzed, updated, and then accepted by a certification agent, confirming the security controls described are consistent with [FIPS 199](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.199.pdf) and [FIPS 200](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.200.pdf). ### 6. Certification and Accreditation Once a risk assessment and system security plan are complete, FISMA requires program officials and agency heads to conduct annual security reviews to ensure security controls are sufficient and risk is sufficiently mitigated. FISMA certification and accreditation is a four-phase process that includes initiation and planning, certification, accreditation, and continuous monitoring. [NIST SP 800-37 Guide for the Security Certification and Accreditation of Federal Information Systems](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-37.pdf) outlines this process in detail. By accrediting an information system, an agency official accepts responsibility for the security of their systems and is fully accountable for any adverse impacts of a [data breach](https://www.upguard.com/blog/data-breach), [data leak](https://www.upguard.com/blog/data-leak), unauthorized access, or other security incidents. ### 7. Continuous Monitoring All FISMA-accredited systems must monitor their selected security controls, with documentation updated to reflect changes and modifications to the system. Large changes should trigger an updated risk assessment and may need to be recertified. Continuous monitoring activities include [configuration management](https://www.upguard.com/blog/5-configuration-management-boss), control of information system components, the security impact analysis of changes to the system (like [security ratings](https://www.upguard.com/blog/what-are-security-ratings)), ongoing assessment of security controls, and status reporting. ## What are the Benefits of FISMA Compliance? FISMA compliance has increased the security of sensitive federal information, protecting national security interests, and continuous monitoring provides agencies with information about how to maintain their security and eliminate [vulnerabilities](https://www.upguard.com/blog/vulnerability) in a cost-effective manner. For private-sector companies who do business with federal agencies, FISMA compliance can provide a leg up over other organizations when vying for federal contracts. By meeting FISMA compliance requirements, the added benefit is that companies improve their organization's data protection, prevent data breaches, and improve [incident response planning](https://www.upguard.com/blog/incident-response-plan).   ## What are the Penalties for Failing to Comply with FISMA? For government agencies and third-party vendors, failing to comply with FISMA could result in congress censure, reducing federal funding, reputational damage, government hearings, loss of future contracts, and poor cybersecurity infrastructure. ## What are FISMA Compliance Best Practices? * **Classify information as its created: **This will allow you to prioritize security controls for your most sensitive information first. * **Encrypt sensitive data:** [Encryption](https://www.upguard.com/blog/encryption) is a great way to protect confidential data and reduce the impact and cost of data breaches. * **Run regular risk assessments:** Risk assessments should be performed on a periodic basis to identify [vulnerabilities](https://www.upguard.com/blog/vulnerability), security gaps, and outdated policies * **Conduct employee training and education:** Human error is the most common reason for data breaches and leaks. Training employees and providing cybersecurity education can significantly reduce the chances of costly errors. * **Maintain evidence of FISMA compliance:** Record what work your organization has done to achieve FISMA compliance, such as the inventory of information systems, risk categorization framework, security controls, past risk assessments, system security plans, certifications, accreditations, and [continuous monitoring solutions](https://upguard.com/).   * **Stay current with new regulations:** Always stay updated on changes to FISMA standards or new NIST guidelines. ## How UpGuard Can Help Maintain FISMA Compliance UpGuard's [security questionnaire automation tool](https://www.upguard.com/product/vendor-risk/questionnaire-management) can minimize the time your organization spends managing third-party relationships by automating [vendor questionnaires](https://www.upguard.com/articles/planning-your-vendor-security-assessment-questionnaire), building customizable questionnaires to tailor by each specific vendor, and continuously monitoring your vendors' [security posture](https://www.upguard.com/blog/security-posture) over time while benchmarking them against their industry. Our platform scores your vendors daily with a [security rating](https://www.upguard.com/blog/what-are-security-ratings) out of 950. Each vendor is rated against 50+ attack vectors, such as the presence of [SSL](https://www.upguard.com/blog/ssl-certificate) and [DNSSEC](https://www.upguard.com/blog/dnssec), as well as the risk of [domain hijacking](https://www.upguard.com/blog/domain-hijacking), [man-in-the-middle attacks](https://www.upguard.com/blog/man-in-the-middle-attack), and [email spoofing](https://www.upguard.com/blog/email-spoofing) for [phishing](https://www.upguard.com/blog/phishing). UpGuard can also help meet FISMA requirements by assessing vendor cyber risks. [UpGuard Breach Risk](https://www.upguard.com/product/breach-risk) can help monitor for DMARC, combat [typosquatting](https://www.upguard.com/blog/typosquatting), prevent data breaches and [data leaks](https://www.upguard.com/blog/data-leak), avoid regulatory fines and protect your customer's trust through [cyber security ratings](https://www.upguard.com/blog/what-are-security-ratings) and continuous exposure detection. eBook A Complete Guide to Third-Party Risk Management Free resource ### A Complete Guide to Third-Party Risk Management Learn how to protect your business with an effective cybersecurity program. [Download now](/resources/complete-guide-to-third-party-risk-management) ## Related posts Learn more about the latest issues in cybersecurity. Compliance and Regulations #### [Cyber Resilience Act Preparedness: Who's Ready, and Who Can't Be Reached](/blog/cyber-resilience-act-preparedness-whos-ready-and-who-cant-be-reached) We surveyed 2,374 EU-registered devices and 226 listed software makers for a way to report a vulnerability. Market leaders are ready. Others, not so much. [](/team/greg-pollock) [Greg Pollock](#) October 13, 2026 Human Cyber Risk #### [AI Assurance: The Third Head of Your AI Governance Watchdog](/blog/ai-governance-to-ai-assurance) AI governance needs three things: policy, enforcement, and assurance. Most organizations have built the first two. Here's why the third one matters now. [](/team/shane-moosa) [Shane Moosa](#) September 21, 2026 Compliance and Regulations #### [NIST compliance in 2026: A complete implementation guide](/blog/nist-compliance) NIST compliance ensures alignment with leading cybersecurity frameworks. Explore how the NIST standards can safeguard sensitive data and manage third-party [](/team/edward-kost) [Edward Kost](#) January 5, 2026 Compliance and Regulations #### [Introducing UpGuard’s DPDP Act Security Questionnaire](/blog/upguards-dpdp-security-questionnaire) Discover the latest addition to UpGuard's industry-leading Questionnaire Library and learn how to achieve comprehensive DPDP compliance. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) November 19, 2024 Compliance and Regulations #### [From NIS to NIS2: What Your Organization Needs to Know](/blog/nis-vs-nis2) Understanding the transition from NIS to NIS2 is crucial for protecting your organization. Explore the key changes and compliance steps in this blog. [](/team/leah-sadoian) [Leah Sadoian](#) July 4, 2025 Compliance and Regulations #### [How to Prepare for a Cyber Essentials Plus Audit](/blog/prepare-for-a-cyber-essentials-plus-audit) Learn more about the Cyber Essentials Plus independent assessment process, and steps your organization can take to prepare. [](/team/leah-sadoian) [Leah Sadoian](#) July 3, 2025 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)