Topic · fisma

FISMA

Federal Information Security Modernization Act — the umbrella statute governing federal-system security.

RSS feed ↗

trade-press
NSPM-12 pushes agencies toward NSA-centered cyber assessments
The memo may reduce self-graded security theater, if agencies can reconcile it with the assessment regimes already claiming the field.
A MeriTalk contributed piece from Armis by ServiceNow says National Security Presidential Memorandum 12 elevates federal cybersecurity by putting security assessments and recommendations under the National Manager for National Security Systems, operating under the NSA director. The directive also requires agencies to maintain and annually update inventories of national security systems and urges consistency across civilian and defense organizations. The hard part is not the slogan. It is avoiding another assessment lane agencies must satisfy without clearer criteria.
JUL 10
trade-press
Trump rewires NSS cyber governance under NSA-led CNSS
The memo moves classified-system cybersecurity back toward a centralized national-security chain of command, with the hard requirements still unwritten.
President Trump’s June 12 National Security Memorandum revokes Biden-era NSM-8 and the 1990 National Security Directive 42, reestablishing the Committee on National Security Systems to issue binding directives for National Security Systems. Primes, defense-industrial-base suppliers, C3PAOs and agencies operating classified or mission systems now have to watch CNSS and the NSA Director, not the EO 14028 civilian-agency model, for the next baseline.
JUN 13
trade-press
OMB rescinds M-21-31, shifts federal logging to risk-based model
Agencies get more discretion on what logs to keep, but a 90-day CISA reference architecture and a three-tier compliance ladder arriving on a 120-to-320-day clock suggest the flexibility has limits.
OMB Director Russell Vought's May 22 memo rescinds M-21-31 and replaces its prescriptive logging maturity model with a risk-based framework centered on Continuous Event Monitoring (CEM) and Threat Hunting Investigation, Response and Forensics (THIRF). CISA has 90 days to publish a Logging Reference Architecture (LRA); agencies then have 90 more days to submit an agency logging plan, followed by tiered compliance deadlines of 120, 180, and 320 days for levels one through three. This is the second Trump-era OMB memo rolling back Biden's 2021 cyber executive order requirements. The open question is whether "risk-based" means fewer logs stored or simply more agency paperwork justifying which logs to keep.
MAY 27
trade-press
M-26-14 revokes federal logging mandate before CISA replacement is ready
Rescinding M-21-31 now while giving CISA 90 days to publish a reference architecture leaves agencies with no enforceable logging standard for at least six months.
OMB memorandum M-26-14, released Friday, replaces Biden-era M-21-31 with a risk-based logging framework and directs CISA to produce a reference architecture within 90 days; agencies then get another 90 days to file implementation plans. The problem: M-21-31 was rescinded immediately, not upon delivery of the replacement. Federal agencies have no binding logging requirements for what the Institute for Security and Technology's Nick Leiserson estimates as six months or more, covering any breaches that occur while the architecture is still being written.
MAY 26

FISMA

NSPM-12 pushes agencies toward NSA-centered cyber assessments

Trump rewires NSS cyber governance under NSA-led CNSS

OMB rescinds M-21-31, shifts federal logging to risk-based model

M-26-14 revokes federal logging mandate before CISA replacement is ready