FISMA Services
The Federal Information Security Management act (FISMA) is the main law in the United States for the protection of unclassified sensitive government data. It requires that organizations handling sensitive government data, not only implement appropriate technical and organizational controls, but also that they exercise due diligence and have accountability for the data.
We will apply the NIST Risk Management Framework (RMF) process to identify the appropriate security controls. Our Assessment will help you identify strengths and potential gaps when meeting the compliance requirements of the standard.
E2ECYBER’s experts have extensive experience with federal government requirements both on the civilian (NIST 800-53) and the defense (NIST 800-171) sides. We have worked on FISMA requirements for the Department of Health and Human Services, National Institutes of Health, Department of Homeland Security, DOD research and development companies, and others.
Why is it important?
The FISMA law contains regulations applicable to organizations that are handling sensitive unclassified government information. Compliance is mandatory for all government agencies and federal government contractors.
What are the benefits?
Our FISMA Assessment offers the following benefits:
- Performed by experts with extensive experience in the government
- Provides a quick and actionable roadmap for compliance
What are our offerings?
The assessment benchmarks the organizations current practices, processes and controls for FISMA compliance (NIST 800-53, NIST 800-171 and/or DFARS, as applicable) to identify gaps.
The deliverable will contain the results of the baseline and a roadmap to compliance.
Our experienced consultants will assist with defining and documenting the system inventory.
Our experts will document the risk categorization according to FIPS 199 “Standards for Security Categorization of Federal Information and Information Systems”.
Our experts will create and maintain the required SSP.
Using the NIST 800-53 framework, our experts will create and document the controls in an ISSP.
We will define and document the risk assessment in a Risk Assessment Profile (RAP) document.
Our experts will implement initiation and planning, certification, accreditation, and continuous monitoring to obtain an Authority To Operate (ATO).