McAfee automates FISMA compliance

A new version of McAfee’s Foundstone Enterprise risk management software will automatically tell customers whether they comply with the Federal Information Security Management Act (FISMA) of 2002 and four other federal and commercial regulations, the company announced Oct. 31.

Available as an update for existing customers, Foundstone Enterprise 4.2 evaluates a customer’s network and assesses whether it complies with the regulations’ vulnerability and configuration requirements. The application also specifically advises courses of action to make noncompliant elements compliant.

Foundstone Enterprise 4.2 contains templates that monitor requirements for FISMA, the Sarbanes-Oxley Act of 2002, the Health Insurance Portability and Accountability Act of 1996, the Payment Card Industry Data Security standard, and the ISO 17799/British Standard 7799 for risk management.

The upgrade goes beyond risk management to enable customers to audit themselves and improve their compliance, Mike Carpenter, McAfee’s vice president of federal operations, said in an e-mail message.

“This way, they are ahead of the curve instead of playing catch up,” Carpenter said. The upgrade is also designed to reduce the time and money McAfee customers spend staying compliant with the regulations.

McAfee worked with the Justice Department to create the update, Carpenter said. Keeping information secure and meeting regulatory requirements are two of the department’s top priorities, said Dennis Heretick, chief information security officer at Justice.

“Foundstone gives us a window into our security posture by identifying vulnerabilities and noncompliance with department policies,” Heretick said in an e-mail message.

The application “helps reduce security and compliance costs, manage risk more effectively and improve reporting and security metrics," he said.