FISMA

What it is

The Federal Information Security Modernization Act (2014, amending the 2002 Act). It requires every US federal agency to develop, document, and implement an information-security program for the systems that support its operations — including systems run by contractors on the agency’s behalf.

Who it applies to

Federal agencies and the contractors and systems that handle federal information. FedRAMP is the cloud-specific implementation of FISMA — cloud federal systems do FedRAMP; on-prem systems do FISMA directly.

Disclaimer. Not legal advice. Verified 2026-05-29.

How compliance works — the NIST Risk Management Framework (RMF)

FISMA compliance is operationalized through NIST SP 800-37, the Risk Management Framework, a 7-step lifecycle:

Prepare — context, roles, risk strategy.
Categorize the system (FIPS 199 — Low/Moderate/High).
Select controls (NIST 800-53 baseline for that level).
Implement the controls.
Assess — verify they work (often via an independent assessor).
Authorize — an Authorizing Official accepts the risk and grants an ATO.
Monitor continuously.

The deliverables mirror FedRAMP: System Security Plan (SSP), Security Assessment Report (SAR), POA&M, and an ATO decision.

Key point for builders

FISMA itself adds little new engineering beyond what NIST 800-53 already specifies — it’s the process wrapper (categorize → select → implement → assess → authorize → monitor) that turns the control catalog into an authorization. Build to the 800-53 baseline and the FISMA artifacts largely write themselves. Agencies report FISMA metrics to OMB and DHS/CISA annually; CISA also issues Binding Operational Directives (BODs) that function as mandatory requirements.

FedRAMP — FISMA for cloud
NIST 800-53 — the controls FISMA selects from
Security Overview

Sources (verified 2026-05-29)

Claim	Source
FISMA program & RMF	NIST FISMA / RMF
RMF 7-step process	NIST SP 800-37 Rev 2
CISA oversight & BODs	CISA