FISMA 2.0 Picks Up Steam

A bill that rewrites the 2002 Federal Information Security and Management Act (FISMA) was introduced by Rep. Diane E. Watson, D-Calif., o n Wednesday. Vivek Kundra, federal chief information officer for the Obama administration, didn't state his approval for any specific measures in the bill but did reiterate his disdain for the ongoing paper-based compliance measures supported by current law.

This is a really cool bill for a number of reasons, but mostly because it seems to have found some consensus in and outside of the federal government. Consensus, as anyone inside the Beltway can attest, is hard to come by. Yet, two panels testified, one of government employees, and the other of cybersecurity experts from the private sector, that FISMA 2.0 is in principle a step in the right direction.

A particularly useful analogy was provided by John Gilligan, former chief information officer of the Department of Energy, who said the implementation of 2002 FISMA was like getting on a treadmill as a means to a destination. The analogy continued; while the implementation of the old law has helped burn a lot of calories, we still have gotten any closer to the goal of securing our federal computer systems.

The Watson bill is H.R. 4900, "the 2010 Federal Information Security Act." Below are some of the more important measures I could find in the legislation:

- Establishing a "National Office for Cyberspace" within the Executive Office of the President, with a director appointed by the President. The office would be responsible for overseeing agency information security policies and practices.

- Creating a "Federal Cybersecurity Practice Board" inside of this new cyberspace office made up of members from the Office of Management and Budget, civilian agencies, the Department of Defense, the law enforcement community, and other military and civilian agencies the director considers appropriate. The board would be responsible for developing and periodically updating information security policies and procedures.

- Implementation of an agencywide information security program that continuously monitors information systems, runs penetration testing, and ensures policies and procedures set out by the new office are followed.

All-in-all the bill falls very much in line with the successful continuous monitoring system set up at the State Department. It remains to be seen if the bill will make it to the floor during this legislative session, but if it does, I see it passing with relative ease.

There are two main reasons for the likelihood of easy passage. First, the bill appears as if it will have enough support from the right mix of partners. Second, cybersecurity is complicated stuff, most of which didn't seem to be even entirely understood by Watson, the bill's sponsor. That's not a low blow intended for Watson or anyone else in Congress, it's just the way it is. Clearly Congress is putting a lot of faith in Obama's new cyber team, and if it says "go," with the support of the experts, I'm not sure there's anyone left with enough knowledge to raise a stink. However, three hot-button issues could become possible points of contention for the bill:

The fight between Information sharing and information protection. Does the new National Office for Cyberspace get set up at the White House or the Homeland Security Department? Republicans want it set up at DHS, not the White House. And lastly, how much physical security does the bill require. Physical security tends to be a point of emphasis by congressional members because it's more easily understood. But all-in-all, today was a good one for cybersecurity advocates.