Categorize/Create an Inventory of Information SystemsДЄlthough FISMA originally applied to federal agencies the act has since been expanded to include state agencies implementing federal programs.The process can be divided into six steps: The framework begins with an organization categorizing systems, finding the ideal security controls, implementing them, and assessing the long term effect.

The NIST SP 800-53 Risk Management Framework sets out a systematic process for ensuring compliance. NIST SP 800-53 discusses the security controls under the act.

The National Institute of Standards and Technology Special Publication 800-53, or NIST 800-53 is a set of industry standards from NIST that set guidelines on what federal agencies and contractors need to do to comply with FISMA. More information on the security standards can be found in NIST SP 800-53. The score is used to indicate how secure your internal systems are and determine how protected is the data you hold. Under FISMA, companies and government agencies are graded with a FISMA score. FISMA was part of the larger E-Government Act of 2002, which sought to bring the IT management of government agencies up to scratch. What is FISMA?ДЄs outlined briefly above, FISMA was an act passed in US law that determined how government agencies could manage IT systems and data. FISMA was passed in 2002 to impose regulations on how federal agencies handle data. The Federal Information Security Management Act or FISMA is a federal law passed in the United States that requires federal agencies to implement and maintain an information security strategy.

Scores on my checklist