FISMA Certification and Accreditation Handbook

Foreword

When I was the Security Staff Director of the Federal Deposit Insurance Corporation (FDIC), the Federal Information Security Management Act of 2002 (FISMA) was not yet in existence; however, the Government Information Security Reform Act (GISRA) was. Since GISRA was signed into law on October 30, 2000, U.S. federal agencies have been paying far more attention to information security than they did previously.

In 2002, FISMA was signed into law, creating more specific regulations for U.S. federal agencies than those established by GISRA. Today, with FISMA, and the process known to support FISMA, Certification and Accreditation (C&A), agencies are far more diligent about assessing their security controls and vulnerabilities. Despite what ...