FISMA

Federal Information Security Modernization Act: software inventory, vulnerability, supply chain risk.


Region	Americas
Country or scope	United States
Sector	Government
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers FISMA

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 11 controls from Safeguard's control catalog for FISMA.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 25: 3 written for FISMA and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`FISMA-3505-INV` System and Software Inventory	Agencies must maintain an inventory of major information systems, operationalized through NIST controls requiring component-level software inventories (44 U.S.C. 3505(c); NIST SP 800-53 CM-8)	Scan
`FISMA-3554-PROT` Information Integrity Protections	Agencies must provide protections commensurate with risk against unauthorized modification of information and systems, supported by integrity hashes for deployed software (44 U.S.C. 3554(a)(1)(A); NIST SP 800-53 SI-7)	Scan
`FISMA-SI-2` Flaw Remediation	Security programs must include processes for planning and remediating deficiencies, requiring current version data for the software in agency systems (44 U.S.C. 3554(b); NIST SP 800-53 SI-2)	Scan
`FISMA-RA-5-ID` Scan-to-Inventory Correlation	Periodic testing and vulnerability assessment require components identifiable via standard identifiers so findings map to owned assets (44 U.S.C. 3554(a)(2)(D); NIST SP 800-53 RA-5)	Scan
`FISMA-SR-SUP` Supply Chain Risk Visibility	Federal systems must manage supply-chain risk, including knowing the sources of acquired software, per the SR control family adopted in Rev 5 baselines (NIST SP 800-53 SR-3/SR-4 under FISMA implementation)	Scan
`FISMA-EO14028` Machine-Readable Composition Evidence	Federal software supply-chain policy following EO 14028 and OMB M-22-18 anticipates SBOMs in standard machine-readable formats (SPDX/CycloneDX) as attestation artifacts (EO 14028 s.4; OMB M-22-18)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`FISMA-RA-01`	Conduct and document a system risk assessment
`FISMA-CA-01`	Obtain Authorization to Operate (ATO)
`FISMA-CA-02`	Perform security control assessments
`FISMA-PL-02`	Develop and maintain a System Security Plan
`FISMA-IR-01`	Establish incident reporting to US-CERT
`FISMA-CM-01`	Maintain a continuous monitoring program
`FISMA-AT-01`	Provide annual security awareness training
`FISMA-SC-01`	Implement FIPS-validated cryptography
`FISMA-POA-01`	Manage Plans of Action and Milestones (POA&M)
`FISMA-SA-01`	Apply NIST SP 800-53 security control baselines
`FISMA-ID-01`	Categorize information systems per FIPS 199

Policy templates

Written for FISMA:

System Authorization (ATO) Policy
Plan of Action and Milestones Management Policy
Annual FISMA Reporting and Review Policy

And 22 from the standard set, adapted to FISMA.