FISMA Compliance for IT Contractors

FISMA is the law behind US federal cybersecurity. It tells every federal agency to protect its information systems using NIST standards, and that obligation flows down to the contractors, integrators and service providers that build or run systems for agencies. If your IT company develops, hosts or operates a system for a US federal agency, you will be asked to support FISMA compliance. This guide explains what FISMA requires, who is responsible for what, how the Risk Management Framework is used, and what contractors need to put in place.

What is FISMA?

FISMA establishes a framework for protecting federal government information, operations and assets. It requires each agency to develop, document and implement an agency-wide information security programme, and assigns oversight and operational roles to central bodies.

Full form and definition

FISMA now stands for the Federal Information Security Modernization Act of 2014 (Public Law 113-283). The acronym originally referred to the Federal Information Security Management Act of 2002, Title III of the E-Government Act of 2002, which the 2014 Act largely replaced.

Law, standard or certification?

FISMA is a law. It is implemented through OMB policy (notably OMB Circular A-130), NIST standards and guidelines (FIPS 199, FIPS 200, SP 800-37, SP 800-53), and CISA directives. There is no "FISMA certification"; systems receive an Authorization to Operate (ATO) from an agency official.

History and background of FISMA

The 2002 Act made information security a legal duty for every agency and gave NIST responsibility for developing standards. Critics argued it encouraged paperwork compliance with periodic re-certification rather than real-time security.

The 2014 Act modernised the law: it gave the Department of Homeland Security (now through CISA) operational responsibility, including binding operational directives, kept OMB in charge of policy and oversight, emphasised continuous monitoring and automated tools, and updated incident reporting duties, including notification to Congress of major incidents.

Why was FISMA introduced?

Federal agencies were suffering frequent intrusions with inconsistent security practices and little accountability. Congress wanted a single, risk-based approach with clear responsibilities and regular reporting.

Main objectives and purpose

• Provide a comprehensive framework for effective security controls over federal information and systems.
• Ensure government-wide management and oversight of information security risks.
• Develop and maintain minimum controls through NIST standards.
• Improve oversight through annual reporting and independent evaluations.
• Strengthen incident detection, reporting and response.

Who needs to comply with FISMA?

• Federal executive agencies, for all their information systems.
• Contractors and other organisations that collect or maintain information, or operate information systems, on behalf of an agency. Requirements reach them through contract clauses.
• State agencies administering federal programmes, such as benefits and health programmes, may be required by the funding agency to meet FISMA-derived controls.

Cloud services used by agencies are authorized through FedRAMP, which applies FISMA principles to cloud. Contractors protecting Controlled Unclassified Information on their own internal systems generally follow NIST SP 800-171 rather than the full FISMA process.

Geography

United States federal government. Foreign IT companies are affected only when they perform work on federal systems, which often requires US personnel and data location.

Key requirements of FISMA

Agency security programme

• Inventory of information systems
• Risk assessments and risk-based policies and procedures
• Security categorisation of systems (FIPS 199)
• Minimum security controls (FIPS 200 and NIST SP 800-53 baselines)
• System security plans
• Security awareness training for all users and role-based training
• Periodic testing and evaluation of controls, at least annually
• Remediation processes (plans of action and milestones)
• Incident detection, reporting and response
• Continuity of operations plans

Roles and responsibilities

FISMA roles

Role	Responsibility
OMB	Policy, oversight and annual report to Congress
CISA (DHS)	Operational support, binding operational and emergency directives, incident coordination
NIST	Standards and guidelines
Agency head, CIO and CISO	Agency-wide programme and accountability
Inspectors General	Annual independent evaluation of agency programmes
Authorizing officials	Accept risk and grant ATOs for systems

Incident reporting

Agencies report incidents to CISA under federal incident notification guidelines, and must notify Congress of major incidents. Contractors are bound by the reporting terms in their contracts, which are often stricter than commercial norms.

Annual reporting

Agencies report security metrics to OMB and CISA, and Inspectors General evaluate programme maturity using metrics organised around the NIST Cybersecurity Framework functions. OMB summarises results in an annual report to Congress.

How FISMA compliance works: the Risk Management Framework

1. Prepare: organisational roles, risk strategy and common controls.
2. Categorize the system based on impact (Low, Moderate, High).
3. Select and tailor the SP 800-53 baseline.
4. Implement controls and document them in the system security plan.
5. Assess controls with independent assessors.
6. Authorize: the authorizing official grants an ATO based on residual risk.
7. Monitor continuously, report changes and update the plan of action and milestones.

What contractors should do

1. Read the security clauses in the contract and identify the required baseline and reporting duties.
2. Confirm the system boundary and which controls the agency provides versus the contractor.
3. Implement controls and maintain the SSP and supporting documents.
4. Support the agency's assessment and remediate findings.
5. Run continuous monitoring and report incidents within contract deadlines.
6. Train staff with access to federal systems.

Documentation required

• System inventory and FIPS 199 categorisation
• System security and privacy plan
• Policies and procedures for each control family
• Security assessment plan and report
• Authorization package and ATO letter
• Plan of action and milestones
• Continuous monitoring strategy and reports
• Contingency plan and incident response plan
• Training records

Audit and assessment requirements

Systems are assessed before authorization and continuously monitored afterwards. Inspectors General perform annual independent evaluations of each agency's programme, and the Government Accountability Office audits federal security. Contractors' systems are assessed by the agency or its assessors as part of the authorization.

Estimated implementation timeline

• Authorizing a new Low system: around 6 months
• Moderate system: typically 9 to 18 months
• High system: 18 months or more

Cost considerations

• Engineering for required controls, including FIPS-validated cryptography and detailed logging
• Documentation and assessment support
• Independent assessment costs, sometimes borne by the agency
• Continuous monitoring tools and staff
• Personnel security requirements, such as background investigations

Benefits of FISMA compliance

• Eligibility for federal contracts involving information systems.
• A rigorous, well-documented security programme.
• Strong positioning for state government and regulated industry work.

Risks and consequences of non-compliance

• For agencies: critical IG and GAO findings, congressional scrutiny and budget consequences.
• For contractors: denial or loss of ATO, contract remedies, termination and exclusion from future work.
• Potential False Claims Act liability where contractors knowingly misrepresent cybersecurity compliance; the US Department of Justice's Civil Cyber-Fraud Initiative, launched in 2021, pursues such cases.

Common mistakes

• Treating the ATO as a one-time event.
• SSPs that do not match the real system.
• Unclear division of controls between agency and contractor.
• Missing incident reporting deadlines in the contract.
• Allowing unauthorised tools or offshore access into the boundary.

Challenges for IT companies

• High documentation burden for small contractors.
• Strict personnel and location requirements.
• Agency-specific interpretations of the same controls.
• Keeping up with binding operational directives from CISA.

Best practices and recommendations

• Clarify security requirements during the bid, not after award.
• Use OSCAL-capable tools to keep the SSP current.
• Automate continuous monitoring and evidence collection.
• Reuse controls from authorized cloud providers.
• Map your ISO 27001 or SOC 2 controls to 800-53 to avoid duplicate work.

Tools and technologies that help

• GRC platforms with RMF workflows and 800-53 libraries
• Continuous diagnostics and monitoring tools
• Vulnerability and configuration compliance scanners
• SIEM and log management
• Identity providers with PIV-compatible and phishing-resistant MFA

Relationship with other compliance frameworks

FISMA and related frameworks

Framework	Relationship
NIST SP 800-53	The control catalogue agencies apply under FISMA
FedRAMP	The programme that applies FISMA-based authorization to cloud services
NIST CSF	Structures FISMA reporting metrics and IG evaluations
SOX	A different US law for public company financial reporting; both rely on IT controls

Real-world implementation examples

The following are illustrative composites based on common patterns, not named clients.

Application development contractor

A contractor building a grants management system for an agency clarified in its first month which controls the agency's hosting platform provided, documented the rest in the SSP, and set up monthly scanning and POA&M reporting, achieving a Moderate ATO in 11 months.

State benefits system vendor

A vendor running a state-administered federal benefits system adopted the Moderate baseline required by the federal funding agency and passed the state's annual independent assessment.

Frequently asked questions

What does FISMA stand for?

The Federal Information Security Modernization Act of 2014, which updated the Federal Information Security Management Act of 2002.

Does FISMA apply to private companies?

It applies to contractors and others operating information systems on behalf of federal agencies, through their contracts.

Is there a FISMA certification?

No. Systems receive an Authorization to Operate from an agency authorizing official.

What is the difference between FISMA and FedRAMP?

FISMA is the law; FedRAMP is the programme that authorizes cloud services agencies use, based on FISMA principles and NIST controls.

Which NIST publications support FISMA?

Mainly FIPS 199, FIPS 200, SP 800-37 (Risk Management Framework), SP 800-53 and SP 800-53A.

What are the penalties for FISMA non-compliance?

There are no direct fines for companies. Consequences include loss of authorization and contracts, and False Claims Act liability for misrepresentation.

Who enforces FISMA?

OMB oversees compliance, CISA provides operational direction, and Inspectors General and GAO evaluate agencies.

How often must FISMA controls be tested?

Controls must be tested and evaluated at least annually, with continuous monitoring in between.

Do state governments follow FISMA?

Not directly, but state agencies handling federal programme data often must meet FISMA-derived requirements set by the funding agency.

Conclusion and next steps

For IT contractors, FISMA compliance means understanding the contract, implementing the right NIST baseline, documenting accurately and monitoring continuously.

1. Identify FISMA requirements in contracts and bids.
2. Define the system boundary and responsibilities.
3. Implement and document the required baseline.
4. Support assessment and authorization.
5. Monitor and report continuously.

How we keep this guide up to date

We review this guide every six months and whenever OMB issues FISMA guidance, CISA issues binding directives relevant to contractors, NIST updates core publications, or Congress amends the law.