C&A keys FISMA

OMB FISMA guidance for 2003

A study of lessons learned from the first year under the Federal Information Security Management Act (FISMA) seems to pinpoint certification and accreditation (C&A) as the most important aspect of compliance.

Federal chief information officers and Office of Management and Budget officials asked the SANS Institute to conduct the study. SANS, a security education organization, hasn't studied all agencies yet, but common themes are already clear, said Alan Paller, director of research at the institute.

Paller expects the full report will be completed and published by December. So far, officials from several of the government's largest departments see C&A as an important factor because "it's an umbrella over the multiple steps" outlined in OMB's FISMA guidance, he said, speaking today at the Federal Information Assurance Conference in College Park, Md.

The guidance focuses on risk assessments, system controls and up-to-date security plans. Each of these steps, and many others, are included in what administrators must check when putting their system through a C&A process.

Agencies are spending anywhere from $25,000 to $400,000 per system on C&A, but responses also show that one of the best ways to cut down on that cost is to implement a continuous vulnerability monitoring and elimination program, Paller said. At one agency, a program that addresses security problems as they arise instead of waiting for an annual evaluation reduced the C&A cost to $5,500 per system, he said.

CIOs should work with agency inspectors general and the General Accounting Office instead of against them, agency and OMB officials told institute officials. FISMA requires agency CIOs and inspectors general to report annually to Congress and OMB; oversight officials are starting to look at inspector general reports as more reliable than those of CIOs, Paller said.