FISMA Compliance: What It Requires and Who Must Meet It

FISMA compliance means an agency, and any contractor or other organization operating a federal information system for it, running a documented information security program that meets the Federal Information Security Modernization Act. There is no FISMA certificate and no FISMA seal. NIST states plainly that its security guidance suite is not a “FISMA Compliance checklist.” Compliance is a matter of running the program the statute describes and reporting on it each year. This guide sets out who does what, which parts of the statute carry the requirements, and how a university or grantee comes under it. It is written as described on the official pages and statute text on 2026-10-29, when they were checked.

What FISMA is and who runs it

FISMA is part of the E-Government Act (Public Law 107-347, December 2002). According to the NIST Computer Security Resource Center, it “requires each federal agency to develop, document, and implement an agency-wide program” to protect the information and systems that support the agency. The 2014 amendment, the Federal Information Security Modernization Act, updated the 2002 Act; NIST describes the amendment as resulting in less overall reporting and as strengthening the use of continuous monitoring in systems.

Several bodies share the work, and none of them issues a compliance certificate:

Body	Role as described on the official page	Source
Agency head and agency Chief Information Officer	The agency provides protections “commensurate with the risk and magnitude of the harm”; the head delegates to the CIO, who reports annually to the head on program effectiveness.	44 U.S.C. 3554
OMB	Oversight and policy, including Circular A-130, which requires agencies to plan for security, assign responsibility and review controls. FISMA 2014 directed OMB to revise A-130 to remove wasteful reporting.	NIST CSRC; CISA
DHS / CISA	The 2014 Act codifies DHS authority over information security policy for non-national-security Executive Branch systems, places the federal information security incident center within DHS by law, and lets DHS issue binding operational directives to other agencies.	CISA
NIST	Develops information security and cybersecurity standards and guidance for non-national-security systems.	NIST CSRC

Who FISMA applies to

The statute places the duty on federal agencies. NIST adds that “federal agencies, contractors, and other sources that use or operate a federal information system” use its guidance to manage risk. For a university, a research institute or a grantee, the practical question is therefore whether you operate a federal information system or handle one on an agency’s behalf. That is normally set by contract terms, not by the existence of a grant. The official pages do not say that receiving a grant alone brings an institution under FISMA, so this page does not claim it.

Section 3554(b) also requires agency programs to include “security awareness training to inform personnel, including contractors and other users.” That is the clearest statutory hook for contractors, and it is the reason agency contracts often carry security clauses. Read the clause in your own agreement to see what it actually asks of you.

What FISMA requires of an agency program

Under 44 U.S.C. 3554(b), an agency-wide program includes:

• periodic risk assessments;
• policies and procedures based on those risk assessments;
• security awareness training for personnel, including contractors and other users;
• periodic testing and evaluation of the effectiveness of information security policies, procedures and practices;
• procedures for detecting, reporting and responding to security incidents; and
• plans to ensure continuity of operations.

Under 3554(c)(1)(A), the agency reports annually to the OMB Director, the DHS Secretary, congressional committees and the Comptroller General on the adequacy and effectiveness of its information security policies, procedures and practices. Major incidents are reported to Congress, as CISA’s page describes.

How to approach compliance: steps

NIST describes the Risk Management Framework (RMF) as “a flexible, holistic, and repeatable 7-step process” for managing security and privacy risk. It is the usual method agencies and their contractors use to put the 3554(b) elements into practice. A working sequence, drawn from the statute and the NIST description, looks like this:

1. Establish who is accountable: confirm the agency CIO or your contract’s named security contact.
2. Identify the system and the information it handles, and assess risk to it.
3. Select and implement controls from NIST guidance. The control catalogue is covered in the CASRAI guide to NIST SP 800-53 Rev. 5.
4. Train personnel, including contractors and other users with access.
5. Test and evaluate the controls, then keep monitoring them continuously.
6. Set up incident detection, reporting and response, and a continuity plan.
7. Support the agency’s annual reporting with current evidence.

Typical timeline phases

FISMA is a cycle, not a one-time project. The statute’s structure implies these phases, repeated every year: assessment and policy update; implementation and training; testing and evaluation with continuous monitoring through the year; and the annual report by the CIO to the agency head and by the agency to OMB, DHS and Congress. Specific due dates are set by OMB and DHS guidance in force each year, so confirm the current dates with the agency rather than relying on any calendar printed here.

Common mistakes

• Looking for a certificate. NIST says its suite is not a FISMA compliance checklist. The statute describes an agency program, not a credential, so treat a vendor’s “FISMA certified” label as marketing for its own product rather than a statutory status.
• Treating a control catalogue as the whole program. Controls are one part. The statute also requires risk assessment, training, testing, incident procedures and continuity planning.
• Assuming a grant creates the obligation. The obligation attaches to operating or using a federal information system. Check the contract.
• One-time effort. The 2014 amendment strengthens continuous monitoring, so a single point-in-time assessment is not the model.
• Mixing up frameworks. Different NIST publications serve different settings. CASRAI covers NIST SP 800-171 for university research and CMMC in separate guides.

Related programs

Program or document	How it relates to FISMA, per the source	Source
NIST Risk Management Framework	A flexible, holistic, repeatable 7-step process for managing risk; not a FISMA compliance checklist.	NIST CSRC
NIST SP 800-53	NIST security guidance for non-national-security systems, covered in its own CASRAI guide.	NIST CSRC
OMB Circular A-130	Requires agencies to plan for security, assign responsibility and review controls; revised after FISMA 2014 to remove wasteful reporting.	NIST CSRC
CISA binding operational directives	Issued by DHS to other agencies under authority codified in FISMA 2014.	CISA

Frequently asked questions

Is there a FISMA certification?

No. NIST states that its security suite is not a “FISMA Compliance checklist.” The statute asks agencies to run a program with the elements in 44 U.S.C. 3554(b) and to report on it annually. The statute describes a program and annual reporting, not a seal.

Does FISMA apply to contractors?

The statute binds agencies, and NIST says contractors and other sources that use or operate a federal information system use its guidance to manage risk. Section 3554(b) names contractors in the training element. What a contractor must do in practice is defined by its agreement with the agency.

What is the difference between FISMA 2002 and FISMA 2014?

FISMA 2002 is part of the E-Government Act (Public Law 107-347) and created the agency-wide program requirement. The 2014 Act amended it. Per NIST, it results in less overall reporting and strengthens continuous monitoring. Per CISA, it codifies DHS authority, places the federal incident center in DHS and clarifies OMB oversight.

Who enforces FISMA?

OMB has oversight and policy authority, DHS can issue binding operational directives to other agencies, and each agency reports annually to the OMB Director, the DHS Secretary, congressional committees and the Comptroller General. The official pages above do not set out a penalty schedule, so none is given here.

Where do the controls come from?

From NIST guidance. See the guide to NIST SP 800-53 Rev. 5, and the broader NIST Cybersecurity Framework 2.0 guide for the risk-based vocabulary many programs share.

Sources

• NIST Computer Security Resource Center, FISMA background: https://csrc.nist.gov/projects/risk-management/fisma-background, checked 2026-10-29.
• CISA, Federal Information Security Modernization Act: https://www.cisa.gov/topics/cyber-threats-and-advisories/federal-information-security-modernization-act, checked 2026-10-29.
• 44 U.S.C. 3554, Federal agency responsibilities (govinfo): https://www.govinfo.gov/content/pkg/USCODE-2023-title44/html/USCODE-2023-title44-chap35-subchapII-sec3554.htm, 2023 edition, checked 2026-10-29.