ArticlesFebruary 8, 2021, updated October 15, 202612 min read

FISMA Compliance: What It Is, Requirements and Steps

By UTMStack Team

FISMA is the law behind federal cybersecurity. If you work at a federal agency, or run a system for one, it decides how that system is secured, approved for use and watched once it is running. Many companies first meet it in a contract that says a system must be “FISMA compliant”. There is no FISMA certificate to buy. What the phrase really means is that the agency must be able to authorize the system under the standards FISMA points to, and keep it authorized.

This guide explains what FISMA is, who it applies to, what it requires in practice, how monitoring and annual reporting work, what changed in federal logging rules in 2026 and how FedRAMP fits for cloud services.

The short answer: The Federal Information Security Modernization Act of 2014 (FISMA) requires every federal agency to run an information security program covering its information and systems, including systems that contractors operate on its behalf. In practice, FISMA compliance means following standards from the National Institute of Standards and Technology (NIST): categorize each system with FIPS 199, meet the minimum requirements of FIPS 200 through the NIST SP 800-53 Revision 5 controls, take each system through the seven steps of the Risk Management Framework (SP 800-37 Revision 2) to get an authorization to operate, monitor it continuously, and report every year, with an independent evaluation by the agency’s inspector general. Cloud services used by agencies go through the Federal Risk and Authorization Management Program (FedRAMP).

What is FISMA?

The first FISMA was the Federal Information Security Management Act, Title III of the E-Government Act of 2002. The Federal Information Security Modernization Act of 2014 (Public Law 113-283, signed December 18, 2014) replaced its core provisions and is the law in force today, at 44 U.S.C. 3551 to 3558. FISMA 2014 kept the agency-wide security program, gave the Department of Homeland Security a formal role in federal civilian cybersecurity, placed the federal incident center in that department by law, and told the Office of Management and Budget (OMB) to cut wasteful reporting.

Five parties share the work:

OMB sets policy, issues yearly FISMA guidance and oversees compliance.
The Cybersecurity and Infrastructure Security Agency (CISA), part of Homeland Security, administers security practices for civilian systems, issues binding operational directives and runs the federal incident center.
NIST writes the standards, the Federal Information Processing Standards (FIPS), which agencies must follow, and the SP 800 series of guidelines.
Each agency head is responsible for the agency’s program, delegated to the chief information officer and a senior information security officer.
The inspector general (IG) of each agency evaluates the program independently every year.

Who must comply with FISMA

Federal agencies. Every executive branch agency must protect the information it collects or maintains and the systems it uses or operates.
Contractors and other organizations operating systems on an agency’s behalf. The law covers “information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency” (44 U.S.C. 3554(a)(1)(A)(ii)). A company that hosts or runs a system for an agency is inside FISMA, through its contract.

A contractor’s own internal systems, which are not run on an agency’s behalf but hold some government information, are usually handled under other rules, such as NIST SP 800-171 for controlled unclassified information and, for defense contractors, the Cybersecurity Maturity Model Certification (CMMC). The CMMC rule itself says it does not apply to federal information systems operated by contractors on behalf of the government (32 CFR 170.3(b) in the Code of Federal Regulations); those are FISMA systems. National security systems follow separate standards, and FIPS 199 and 200 exclude them.

FISMA requirements in practice

FISMA itself is short on technical detail. It requires each agency to run a program with these elements (44 U.S.C. 3554(b)), and the detail comes from NIST and OMB:

Requirement	What it involves	Where the detail lives
System inventory	A list of the agency’s information systems, which every test must cover	44 U.S.C. 3505(c)
Risk assessment	Periodic assessment of the harm a compromise could cause	44 U.S.C. 3554(b)(1); NIST SP 800-30
Categorization	Rate each system low, moderate or high impact	FIPS 199
Minimum controls	Meet minimum requirements in 17 security areas	FIPS 200; NIST SP 800-53 Rev 5 and SP 800-53B
Authorization	A senior official accepts the risk and approves the system to operate	NIST SP 800-37 Rev 2
Security training	Train staff and contractors on risks and their duties	44 U.S.C. 3554(b)(4)
Testing	Test controls at least once a year, more often for higher risk	44 U.S.C. 3554(b)(5)
Continuous monitoring	Ongoing awareness of threats, vulnerabilities and control status	NIST SP 800-137; control CA-7
Incident handling	Detect, report and respond to incidents	44 U.S.C. 3554(b)(7); CISA guidelines
Annual reporting	Report to OMB, Homeland Security and Congress; IG evaluation	44 U.S.C. 3554(c) and 3555

OMB Circular A-130 requires agencies to apply the Risk Management Framework (RMF), which ties these pieces into one life cycle for every system.

The Risk Management Framework in seven steps

How a federal system goes from design to an authorization to operate, and stays there

1. PrepareSet roles, risk strategy and common controls for the organization and the system
2. CategorizeRate the impact of a loss of confidentiality, integrity or availability (FIPS 199)
3. SelectPick the SP 800-53 baseline for that impact level and tailor it
4. ImplementPut the controls in place and describe them in the security plan
5. AssessTest that controls are implemented correctly and working as intended
6. AuthorizeA senior official accepts the remaining risk and grants an authorization to operate
7. MonitorWatch controls, threats and changes continuously, and report

Steps from NIST SP 800-37 Revision 2. The Monitor step is where logging, a SIEM and vulnerability scanning do most of their work.

FIPS 199 and FIPS 200

FIPS 199 (February 2004) rates the potential impact of a security failure as low, moderate or high, separately for confidentiality, integrity and availability. FIPS 200 (March 2006) takes the highest of the three ratings, the “high water mark”, as the system’s overall impact level, and sets minimum security requirements in 17 areas, from access control and audit and accountability to incident response and system and information integrity.

How the high water mark works

An example system rated under FIPS 199

ConfidentialityModerateDisclosure would cause serious harm

IntegrityHighTampered records could cause severe harm

AvailabilityModerateAn outage would cause serious harm

Highest of the three

ResultHigh-impact systemStart from the high baseline in NIST SP 800-53B, then tailor

An illustration, not a real system. Rules from FIPS 199 and FIPS 200.

NIST SP 800-53 Revision 5

SP 800-53 is the catalog of controls. Release 5.2.0, issued in August 2025, has 20 control families and just over 1,000 controls and control enhancements in effect. SP 800-53B groups them into low, moderate and high baselines, plus a privacy baseline. The families most tied to monitoring are Audit and Accountability (AU), which covers event logging, review, retention and protection, and System and Information Integrity (SI), including SI-4, system monitoring. Our guide to NIST 800-53 controls goes family by family.

Continuous monitoring and the 2026 logging rules

NIST SP 800-137 defines information security continuous monitoring: keeping ongoing awareness of security, vulnerabilities and threats so officials can make risk decisions. Control CA-7 asks for it on every system. In practice it means asset inventories, vulnerability scans, configuration checks and, above all, security logs that someone or something reviews.

Federal logging rules changed this year. On May 22, 2026, OMB memo M-26-14 rescinded M-21-31, the 2021 memo that had set agency logging maturity levels and long retention periods. The new memo asks agencies to prioritize two objectives: continuous event monitoring, and threat hunting, investigation, response and forensics. It covers agency systems, including those run by third parties on an agency’s behalf, but not national security, defense or intelligence community systems. Its minimum baseline includes:

Logs searchable for at least 6 months and retrievable for at least a year.
Timestamps synchronized to a traceable time source.
Logs that show the identity used, network addresses, ports and protocols, access to or changes and deletions of data, privilege changes, and changes to infrastructure.
Monitoring for alerts from security tools, known indicators of compromise and unusual system or user activity, with automated alerts for all of it.
Logs readily available to the agency’s top-level security operations center, for example through a security information and event management (SIEM) system.

Agency deadlines under OMB M-26-14

Counted from CISA's Logging Reference Architecture, published August 20, 2026

May 22, 2026M-26-14 issuedM-21-31 rescinded
Aug 20, 2026Reference architecturePublished by CISA
Nov 18, 2026Logging plan due90 days
Dec 18, 2026Level 1120 days
Feb 16, 2027Level 2, Intermediate180 days
Jul 6, 2027Level 3, Advanced320 days

Levels apply across all elements of the M-26-14 maturity model: inventory visibility, collection coverage, collection operations, data retention and log management.

Annual reporting and inspector general reviews

Every year, each agency reports on the adequacy and effectiveness of its program to OMB, Homeland Security, Congress and the Government Accountability Office (44 U.S.C. 3554(c)). Separately, the inspector general, or an independent auditor the IG chooses, evaluates the program and tests a representative subset of systems (44 U.S.C. 3555). Under OMB’s fiscal year 2025 guidance (M-25-04), IG metrics were due August 1, 2025 and annual reports October 31, 2025. CISA has since published the fiscal year 2026 metrics for chief information officers.

IGs score agencies on a five-level maturity model: ad hoc, defined, consistently implemented, managed and measurable, and optimized. OMB treats Level 4, managed and measurable, as an effective level of security. The metrics follow the functions of the NIST Cybersecurity Framework (CSF) 2.0: govern, identify, protect, detect, respond and recover.

Incidents follow tighter clocks. Agencies report incidents to CISA within one hour of identification by their top-level incident response team. Under M-25-04, a major incident must be reported to CISA and OMB within one hour of that determination. The law requires notice to Congress within 7 days (44 U.S.C. 3554(b)(7)).

What happens if an agency falls short

FISMA sets no fines. The consequences are oversight ones: findings in the IG evaluation, reports to Congress, and OMB’s authority to enforce accountability through its budget role over agency technology spending (44 U.S.C. 3553(a)(5)). For a contractor, the risk is contractual: a system that cannot be authorized cannot be used, and contract terms decide the rest.

FISMA and FedRAMP

FedRAMP applies FISMA’s approach to cloud services, so a cloud product is assessed once and reused by many agencies. Congress wrote FedRAMP into law with the FedRAMP Authorization Act, signed December 23, 2022 (44 U.S.C. 3607 to 3616). A FedRAMP package is presumed adequate for an agency’s own authorization, but each agency still authorizes its use of the service. OMB memo M-24-15 (July 25, 2024) set out the program’s modernization.

FedRAMP changed a lot in 2026. Its newer “20x” process is no longer a pilot, the program now speaks of certification paths, and its Consolidated Rules for 2026 become mandatory on January 1, 2027. FedRAMP has said it will stop accepting applications for new certifications on the older Rev5 path on June 11, 2027. If you sell cloud services to agencies, follow fedramp.gov closely.

	FISMA	FedRAMP	CMMC
Applies to	Federal agencies and systems run on their behalf	Cloud services used by agencies	Defense contractors’ own systems with contract information
Legal basis	44 U.S.C. 3551 to 3558	44 U.S.C. 3607 to 3616	32 CFR Part 170 and defense contract clauses
Control set	NIST SP 800-53 baselines	NIST SP 800-53 baselines on the Rev5 path; FedRAMP’s own rules on 20x	NIST SP 800-171 Rev 2 (and SP 800-172 at Level 3)
Result	Agency authorization to operate	FedRAMP certification, reused by agencies	CMMC status recorded by the Department of Defense

How UTMStack fits

We build UTMStack, so weigh our view accordingly. A SIEM supports the monitoring side of FISMA: the AU family, SI-4, continuous monitoring under CA-7 and the M-26-14 logging baseline. UTMStack collects logs from Windows and Linux agents, network devices, firewalls and cloud platforms, checks every event against more than 600 detection rules mapped to MITRE ATT&CK as it arrives, and turns alerts into incidents your team can track to closure. Its agents also run vulnerability scans and keep a software inventory on Windows and Linux. Retention goes up to 5 years, and older data in the cold tier stays searchable without a restore, so you can keep logs searchable well beyond the M-26-14 minimums. See log management for how storage works.

The compliance module uses one control library based on NIST SP 800-53 and scores frameworks such as NIST SP 800-171 Rev 3 and NIST CSF 2.0 (Enterprise edition). It does not score FISMA as a framework of its own, and your agency still owns the authorization.

UTMStack is open source and listed in CISA’s catalog of free cybersecurity services and tools. It installs on your own Linux servers, inside your system boundary, and the installer works on networks with no internet access. UTMStack Cloud is not FedRAMP authorized, so agencies and contractors running federal systems should host it themselves. Start with the free edition or the live demo. For how logging rules compare across frameworks, see SIEM compliance requirements by framework.

Frequently asked questions

What is FISMA? The Federal Information Security Modernization Act of 2014, the U.S. law that requires every federal agency to run an information security program and report on it each year. It replaced the core of the 2002 Federal Information Security Management Act.

What are the FISMA requirements? A system inventory, risk assessments, FIPS 199 categorization, FIPS 200 minimum requirements met through NIST SP 800-53 controls, an authorization to operate for each system, security training, at least yearly testing, continuous monitoring, incident reporting and annual reports with an IG evaluation.

Who must comply with FISMA? Federal agencies, and contractors or other organizations that operate information systems on an agency’s behalf.

Is there a FISMA certification? No. Agencies authorize individual systems through the Risk Management Framework. Older documents call this certification and accreditation.

What is the difference between FISMA and NIST? FISMA is the law. NIST writes the standards and guidelines the law points to, such as FIPS 199, FIPS 200, SP 800-53 and SP 800-37.

How does FedRAMP relate to FISMA? FedRAMP applies the same approach to cloud services, so agencies can reuse one security assessment. Each agency still authorizes the cloud services it uses.