Staffer: FISMA bill will pass in the next Congress

A bill intended to elevate information security governmentwide will likely be reintroduced and passed in the Senate in the next congressional session, a Senate staffer has predicted.The Homeland Security and Governmental Affairs Committee approved the updated Federal Information Security Management Act in the waning days of the last congressional session. However, the bill ran out of time for full Senate consideration before Congress adjourned in October, said Erik Hopkins, a professional staff member on the committee’s Federal Financial Management, Government Information, Federal Services and International Security Subcommittee.Cybersecurity will be a top priority of the committee in the next session, Hopkins said Nov. 21 at a security conference sponsored by 1105 Government Information Group, which publishes Federal Computer Week. Sen. Tom Carper (D-Del.), the subcommittee’s chairman, introduced the FISMA bill in the previous congressional session. The timing for reintroducing the bill will depend on the Obama administration’s priorities, Hopkins said.The previous FISMA bill requires agencies to continuously monitor and measure critical criteria to ensure better information security.“I’d say 90 percent of the bill is going to stay the same,” Hopkins said.Under the updated FISMA bill, agencies would still have to prove that they are adequately protecting their networks and the sensitive information on them, he said.“We need to have discussions as to what is the legal framework we need to put in place on Congress’ side, and we’re still having discussions on the audit side,” Hopkins said. The Government Accountability Office, inspectors general and Congress have had some conversations about the framework, he added.“It may be chasing paper, but at the same time, it’s important because it’s proving that somebody did what they’re supposed to be doing,” he said.Establishing a chief information security officers council to develop best practices will also be part of the next version of the FISMA bill, Hopkins said.Congress sees itself as a partner with agencies in making sure that information technology is secure and IT projects perform effectively, he said. He added that under the new administration and Democratic-controlled Congress, there will be more transparency in how agencies spend IT funds, more constructive and solutions-oriented oversight hearings, and more education for lawmakers and staff members.For example, many congressional committees monitor IT projects at the agencies for which they have oversight, he said. To bridge those jurisdictions, some House and Senate staff members meet at least monthly to gain an understanding of what’s happening in their colleagues’ committees, he said.