FISMA reform would elevate White House's cyber authority

The changes to the 2002 Federal Information Security Management Act that passed as part of the House’s Defense Authorization Bill for fiscal 2011 would give the White House more direct control over IT security within agencies.

Rather than setting out static requirements to be met by agencies in securing their information systems, the Federal Information Security Amendment Act of 2010 would establish a National Office for Cyberspace in the Executive Office of the President, with a director who would be confirmed by the Senate, to oversee IT security.

“The Office shall serve as the principal office for coordinating issues relating to achieving an assured, reliable, secure and survivable information infrastructure and related capabilities for the Federal Government,” the amendment reads.

Among the minimum requirements would be continuous monitoring of the status of IT systems, a technology recently added to FISMA requirements through administrative changes. The director of the office would require Senate confirmation—unlike the federal chief technology officer and chief information officer positions—but would lack the budget authority that many FISMA reform proponents insist is necessary.

Related stories

FISMA reform rides on defense spending's coattails

Next steps for continuous network monitoring

NASA's new FISMA approach and what it means for you

FISMA gets the tools to do the job

Under the amendment the director would review agency information security budgets, but would only offer nonbinding approval or disapproval of agency annual budgets before they go to the Office of Management and Budget, which now oversees FISMA compliance. The director would allow to offer recommendations for correcting perceived problems.

The Cyberspace Office would be supported by a Federal Cybersecurity Practice Board that would develop policies and procedures concerning:

• Minimum security controls to provide a baseline of protection
• Measures of effectiveness to provide metrics for minimum controls
• Criteria for commercial products and services used by agencies to meet minimum controls
• Remedies for deficiencies in minimum controls and
• Cooperation with industry and foreign nations on information security issues.

The amendment also would create an Office of Chief Technology Officer in the White House. The federal CTO would be a member of the Domestic Policy Council, but Senate approval would not be required. The CTO would assess overall federal IT conditions and advise the president, lead interagency efforts to implement best practices and best-in-class technology, encourage innovation and adoption of technology, and work with the private sector. The CTO also would publish annual report that would be specifically required to appear on the CTO’s Web site as well as in the Federal Register.

The office would be separate from the federal CTO position that the Obama administration created and which Aneesh Chopra holds. The amendment does not address what would become of that position.

The amendment would repeal the existing chapters of FISMA and replace them with a streamlined version. As with the original FISMA, it acknowledges that “commercially developed information security products offer advanced, dynamic, robust and effective information security solutions,” and is technology neutral in that it does not specify products or tools to achieve goals. As under current legislation, security standards and specifications would be developed by the National Institute of Standards and Technology, with assistance from the National Security Agency, the Defense Department and other agencies.

Also as in current law, the requirements do not apply to national security systems, which would be under the oversight of the secretary of Defense and the CIA director.

Beyond establishing minimum controls, agency heads would be responsible for assuring the information security within their agencies, using a risk-based approach and integrating security into agency mission and planning.

“Each agency shall develop, document, and implement an agencywide information security program approved by the Director of the National Office for Cyberspace,” the amendment says. The plans would include continuous automated technical monitoring of the information infrastructure, testing to assure that security controls are commensurate with risk, and policies to mitigate and correct risks. In general, agencies would automate practices and evaluations to the extent possible.

The director of the Cyberspace Office also “shall ensure the operation of a central federal information security incident center,” that will gather information from and offer operational help to agencies. Agencies must notify the center of security incidents, as well as the National Cyber Investigative Joint Task Force and agency inspectors general.

Operators of national security system will share threat, vulnerability and incident information with center, “to the extent consistent with standards and guidelines for national security systems.”

Annual audits of security policies and practicies, either by an agency IG or an independent auditor, would be required, and all IT acquisitions and contracts would have to include requirements for adequate security. NIST, the General Services Administration, and the Cyberspace Office would oversee minimum requirements for products and product evaluations.