Topic · fisma

FISMA

Federal Information Security Modernization Act — the umbrella statute governing federal-system security.

RSS feed ↗

trade-press
GAO: Only 14 agencies inventoried IoT devices two years late
Agencies blame resources; GAO's report points at OMB, which issued no FY 2026 guidance and conducted zero oversight audits.
GAO's final biennial report on the IoT Cybersecurity Improvement Act finds 14 of 22 civilian CFO Act agencies had established networked device inventories as of September 2026, two years past OMB's September 2024 deadline, and only 10 captured all required metadata. Agencies cite technical constraints and competing priorities. GAO's target is OMB: it hasn't issued FY 2026 guidance, hasn't overseen the inventory mandate, and hasn't updated the deadline. Without those three things, the requirement is a suggestion.
SAT
trade-press
DHS OIG finds TSA privileged accounts unsecured, separated staff still active
The fifth DHS component access-control failure uncovered by OIG audits in recent years points to a systematic FISMA compliance gap that no one appears to be closing.
The DHS Office of Inspector General found TSA failed to secure privileged accounts, perform annual access reviews, and consistently disable accounts for separated employees across its 60,000-person workforce. The vulnerabilities could allow attackers to compromise TSA networks and cause what OIG called "serious or catastrophic damage to operations and assets." TSA attributed the gaps to staff shortages, resource constraints, and inadequate policies. The agency has since begun monthly access reviews and is developing a formal account-disablement process for departing staff. This is the most recent of several DHS-component access-control audits OIG has conducted, Customs and Border Protection was flagged for similar neglect last month.
SAT
trade-press
TIGTA rates IRS cybersecurity program "not effective"
IRS can govern, respond, and recover, but it still can't reliably identify threats, protect systems, or detect intrusions, the three functions that actually stop a breach.
The Treasury Inspector General for Tax Administration rated the IRS's information security program "not effective" for the most recent fiscal year under FISMA assessments. The agency was rated effective in govern, respond, and recover functions but fell short on identify, protect, and detect, the three NIST CSF functions most directly tied to preventing breaches. TIGTA warned that taxpayer data "could be vulnerable to inappropriate and undetected use, modification, or disclosure" if deficiencies aren't addressed.
SEP 18
trade-press
VA Rejects All 19 FISMA Recommendations as CIO Vacancy Hits Two Years
Zero-trust dollars are appropriated, but the department rates itself at the lowest maturity rung for its core defenses, and there's no published plan to change that.
A FISMA audit found VA's information security program deficient in seven areas, yielding 19 OIG recommendations. VA concurred with none, dismissing the audit as "a snapshot in time." The department has operated without a Senate-confirmed CIO for two years and has cycled through two acting CISOs. Meanwhile, zero-trust funding increased in the FY2026 budget, but VA's own assessment puts its defenses at the lowest maturity rung, with no published plan connecting the spending to outcomes.
AUG 25
trade-press
VA fails FISMA audit, non-concurs on 19 recommendations
VA argues the FISMA audit captured a snapshot that missed its continuous monitoring controls, but GAO data shows some vulnerabilities at the department persisted across multiple assessment cycles.
The VA Office of Inspector General reported Monday that an independent FISMA audit for fiscal 2025 found the department deficient in seven areas: vulnerability management, incident response, configuration management, identity and access controls, contingency planning, background investigations, and agency-wide security management. VA formally non-concurred with all 19 recommendations, arguing the audit captured a "snapshot in time" while the department "manages cybersecurity continuously through ongoing monitoring, automated tools, and risk-based decision making." The non-concurrence is unusual, agencies typically accept or negotiate OIG findings. VA's position is complicated by a December 2025 GAO report showing high-risk vulnerabilities at the department persisted 17 to 21 months, well past VA's own 60-day remediation policy.
AUG 25
trade-press
$1.1B VA benefits platform overhaul lacks schedule, cost estimate, OIG finds
The Booz Allen contract was supposed to close this month. The new target is Q2 2034, and VA never built a GAO-compliant schedule or lifecycle cost estimate.
A VA OIG audit found the $1.1 billion Benefits Enterprise Platform modernization, a Booz Allen Hamilton contract meant to close this month, has been pushed to Q2 2034 with no GAO-compliant program schedule and no reliable lifecycle cost estimate. The watchdog also found OIT hosted applications without required security assessments, leaving vulnerabilities unaddressed since 2021. VA concurred with the recommendations. The platform supports pension, vocational rehabilitation, and employment benefits systems, so the eight-year slip doesn't stop at BEP; it cascades across every business line that depends on it.
AUG 11
trade-press
NSPM-12 strips agency waiver power, puts NSA in command
For the first time, a presidential memorandum eliminates unilateral exemption authority across three branches of federal cybersecurity governance and converts NSA from advisor to enforcement officer.
The White House's NSPM-12, issued in June, rescinds the waiver process that let agency heads unilaterally disregard CNSS cybersecurity directives on national security systems. NSA can now order (not just advise) DoD, IC, and FCEB agencies to implement uniform NIST SP 800-53-aligned controls, including cross-domain solutions for separating classification levels. Agencies that object must escalate to CNSS adjudication; self-exemption is dead. The memo also grants the national manager emergency directive authority over any NSS where a threat is "reasonably suspected," with broad latitude on response actions.
AUG 10
trade-press
NSPM-12 pushes agencies toward NSA-centered cyber assessments
The memo may reduce self-graded security theater, if agencies can reconcile it with the assessment regimes already claiming the field.
A MeriTalk contributed piece from Armis by ServiceNow says National Security Presidential Memorandum 12 elevates federal cybersecurity by putting security assessments and recommendations under the National Manager for National Security Systems, operating under the NSA director. The directive also requires agencies to maintain and annually update inventories of national security systems and urges consistency across civilian and defense organizations. The hard part is not the slogan. It is avoiding another assessment lane agencies must satisfy without clearer criteria.
JUL 10
trade-press
Trump rewires NSS cyber governance under NSA-led CNSS
The memo moves classified-system cybersecurity back toward a centralized national-security chain of command, with the hard requirements still unwritten.
President Trump’s June 12 National Security Memorandum revokes Biden-era NSM-8 and the 1990 National Security Directive 42, reestablishing the Committee on National Security Systems to issue binding directives for National Security Systems. Primes, defense-industrial-base suppliers, C3PAOs and agencies operating classified or mission systems now have to watch CNSS and the NSA Director, not the EO 14028 civilian-agency model, for the next baseline.
JUN 13
trade-press
OMB rescinds M-21-31, shifts federal logging to risk-based model
Agencies get more discretion on what logs to keep, but a 90-day CISA reference architecture and a three-tier compliance ladder arriving on a 120-to-320-day clock suggest the flexibility has limits.
OMB Director Russell Vought's May 22 memo rescinds M-21-31 and replaces its prescriptive logging maturity model with a risk-based framework centered on Continuous Event Monitoring (CEM) and Threat Hunting Investigation, Response and Forensics (THIRF). CISA has 90 days to publish a Logging Reference Architecture (LRA); agencies then have 90 more days to submit an agency logging plan, followed by tiered compliance deadlines of 120, 180, and 320 days for levels one through three. This is the second Trump-era OMB memo rolling back Biden's 2021 cyber executive order requirements. The open question is whether "risk-based" means fewer logs stored or simply more agency paperwork justifying which logs to keep.
MAY 27
trade-press
M-26-14 revokes federal logging mandate before CISA replacement is ready
Rescinding M-21-31 now while giving CISA 90 days to publish a reference architecture leaves agencies with no enforceable logging standard for at least six months.
OMB memorandum M-26-14, released Friday, replaces Biden-era M-21-31 with a risk-based logging framework and directs CISA to produce a reference architecture within 90 days; agencies then get another 90 days to file implementation plans. The problem: M-21-31 was rescinded immediately, not upon delivery of the replacement. Federal agencies have no binding logging requirements for what the Institute for Security and Technology's Nick Leiserson estimates as six months or more, covering any breaches that occur while the architecture is still being written.
MAY 26