Services

FISMA Compliance

FISMA — the Federal Information Security Management Act — is the law that requires federal agencies, and the contractors and systems that support them, to protect information and information systems to a defined standard. In practice, that standard is the NIST Risk Management Framework: categorize the system, select and implement controls from NIST SP 800-53, assess whether they're actually working, get an authorization to operate, and then monitor continuously instead of treating security as a one-time project.

Where organizations get stuck

FISMA work tends to go sideways in a few predictable places. System categorization gets rushed, which means the control baseline is wrong from the start. Control implementation gets documented generically instead of describing what the system actually does. The security assessment turns into a document review instead of a real test of whether controls work. And continuous monitoring, which is supposed to be the thing that keeps an ATO meaningful over time, quietly stops happening after the authorization is granted.

How I approach FISMA work

I treat categorization as the foundation it's supposed to be — getting the impact levels right for confidentiality, integrity, and availability before anything else happens. From there, I help select and tailor controls that fit the system's actual architecture and risk, not a copy-pasted baseline. When it's time to assess, I push for evidence that the controls genuinely operate as described: configuration exports, log samples, access reviews, not just a narrative that says "yes, this is implemented."

I also spend real time on the System Security Plan and the Plan of Action and Milestones, because those two documents are what an assessor and an authorizing official actually read closely. A POA&M that's honest about gaps and has a credible remediation timeline is worth more than a plan that claims everything is perfect and falls apart under questioning.

Who this is for

Federal agencies and the contractors supporting them, companies pursuing or maintaining an Authorization to Operate, and organizations that inherited a FISMA obligation through a contract and need someone who's done this before to get the documentation and the actual security posture into alignment.

If you're heading toward an ATO or trying to keep one current, let's talk about where your program stands.