FISMA Compliance Software Solutions
Monitor insider activity. Detect anomalies. Respond to incidents. ALL-IN-ONE
The Federal Information Security Management Act (FISMA) is a US law that imposes information security standards and requirements on all US federal agencies. It was amended in 2014 by the Federal Information Security Modernization Act, which aimed to enable the federal government to better respond to cyber attacks on its departments and agencies.
Guidance for complying with FISMA IT requirements is provided by the National Institute of Standards and Technology (NIST), which lays out standards for categorizing information, recommendations on the types of information and systems to be included in each category, and minimum information security requirements.
Who needs to comply with FISMA?
The objective of FISMA is to ensure the effectiveness of information security controls over information resources that support federal operations and assets by implementing cost-effective security solutions based on the estimated level of cybersecurity risk.
In the beginning, only federal agencies had to comply with FISMA reporting and security requirements. Now, state agencies that manage federal programs, contractors who work with federal agencies, and private sector companies that work with federal agencies must also comply with FISMA.
Who needs to comply with FISMA?
Federal Agencies
Agencies that manage federal programs
Contractors of federal agencies
Stakeholders working with federal systems
Organizations that rely on federal funds
Achieving compliance can be challenging and expensive. Companies have to install new security software for SOX compliance, and employees have to prepare for SOX reporting. Ekran System is insider risk management software that helps you cover most SOX cybersecurity requirements and simplify the auditing process.
FISMA compliance requirements
FISMA requirements for federal organizations and their contractors:
FISMA requirements
01
Inventory information systems
02
Prepare a system security plan
03
Get certified and accredited
04
Categorize risks
05
Evaluate security controls
06
Access risks
07
Ensure continuous monitoring
Inventory information systems. FISMA requires all federal agencies to create and maintain an inventory of information systems that they operate or that are under their control. This inventory must identify the interfaces between all systems within the agency’s network.
Prepare a system security plan. All federal agencies have to develop a security plan and update it regularly. These plans have to comply with NIST SP 800-18 Guide for Developing Security Plans for Federal Information Systems.
Get certified and accredited. Each federal agency has to conduct periodic security reviews to show that they can manage their systems to be FISMA compliant. This is accomplished through a four-phase process: initiation and planning, certification, accreditation, and continuous monitoring.
Assess risks. Federal organizations and their contractors have to validate their security controls and determine if any additional controls are needed to protect critical information. The resulting set of security controls establishes a level of security due diligence for the federal agency and its contractors.
Categorize risks. Each federal agency has to follow FIPS 199 Standards for Security Categorization of Federal Information and Information Systems. This document provides information on how to categorize risks as well as requirements to ensure the highest level of security. Another helpful guide is NIST SP 800-60 Guide for Mapping Types of Information and Information Systems to Security Categories.
Evaluate security controls. Security controls include access controls, incident response, configuration management, and identification and authentication. All major security controls for complying with FISMA are defined in NIST SP 800-53 [PDF]. You should also explore the Federal Information Processing Standard (FIPS) 200 Minimum Security Requirements for Federal Information and Information Systems to learn more about minimum security requirements.
The NIST Risk Management Framework is an essential guide to FISMA compliance, as it offers a risk-based approach to selecting, implementing, and monitoring security controls.
Ensure continuous monitoring. All accredited systems used within a federal agency and by its contractors have to be monitored. Continuous monitoring is required to efficiently manage an organization’s security and eliminate vulnerabilities.
Meeting FISMA security controls with Ekran System
Covering NIST 800-53 security controls is essential for FISMA compliance.
Ekran System offers a set of features to improve access controls, strengthen identification and authentication mechanisms, cover the audit and accountability control family of requirements, and ensure a robust incident response.
Overview of functionality
| Control family | Requirements | Ekran System features |
|---|---|---|
| Access Control |
|
|
| Audit and Accountability |
|
|
| Identification and Authentication |
|
|
| Incident Response |
|
|
Explore more capabilities of Ekran System, which covers most NIST 800-53 requirements.
Using Ekran System to meet FISMA continuous monitoring requirements
Ekran System provides the capability to monitor insider activity, detect abnormal behavior, and respond to incidents. In particular, Ekran System:
- Allows for online and offline monitoring of both in-house and remote users
- Collects monitoring data in secure storage if the connection is down
- Offers Protected mode to prevent monitoring being stopped
- Records each user session in searchable audio and video formats
- Generates detailed, easy-to-analyze reports
You can configure any number of reports and customize them with a corporate logo and contact information. Ekran System can generate your reports ad-hoc or on a schedule.
Meet other IT security requirements with Ekran System
Let’s get the conversation started
Contact our team to learn how our insider risk management software can safeguard your organization’s data from any risks caused by human factors. Book a call with us at a time that suits you best, and let’s explore how we can help you achieve your security goals.
