FISMA Guide: Federal Information Security Requirements, Roles and Reporting

FISMA makes every US federal agency head personally accountable for information security, yet most of what agencies actually do each year is driven by OMB memos, CISA directives and Inspector General metrics that sit on top of the statute. This guide explains the Federal Information Security Modernization Act of 2014 (44 U.S.C. 3551 et seq.) as it operates today: who it covers, what the statute itself requires, how annual reporting and the IG maturity evaluation work, and how major incidents must be reported. It also covers what FISMA means for contractors that run systems on an agency's behalf, and for the service accounts, API keys and AI agents that now operate inside federal systems. It is written for agency CISOs and their teams, federal contractors and cloud providers, and auditors who need the requirements in one place. Status as of 25 October 2026.

Key takeaways

• The statute is short, the obligations are layered. 44 U.S.C. 3554 sets eight program elements for every agency; OMB guidance, NIST standards and CISA binding operational directives turn those into specific, testable requirements.
• Contractor systems are in scope. The agency head must protect information and systems used or operated by the agency or by its contractors, so FISMA duties flow down to integrators and cloud providers through contracts and FedRAMP.
• Major incidents have hard clocks. Under OMB M-25-04, agencies notify CISA and OMB within 1 hour of determining a major incident and Congress within 7 days; any breach involving the PII of 100,000 or more people requires a major incident determination.
• The IG evaluation is a maturity score. Inspectors General rate each domain from Level 1 (Ad Hoc) to Level 5 (Optimized), and OMB treats Level 4 (Managed and Measurable) as effective security.
• Machine identities are now a FISMA problem. Recent federal incidents involved a stolen vendor API key and contractor-held cloud admin keys, so inventories, authenticator management and incident reporting must cover non-human identities, not just people.

Scope: who and what is covered

FISMA 2014 (Public Law 113-283, signed 18 December 2014) replaced the Federal Information Security Management Act of 2002 and is codified in subchapter II of chapter 35 of title 44. It has been amended since (Public Laws 114-113 and 115-390), but no comprehensive reform has been enacted. It applies to federal executive branch agencies and to information systems that support them, whoever operates them.

• National security systems: most OMB and DHS authorities in section 3553 do not apply to national security systems. For qualifying Defense Department and intelligence community systems, OMB's authorities are delegated to the Secretary of Defense and the Director of National Intelligence (3553(e)). M-25-04 explicitly does not apply to national security systems.
• Contractors and cloud providers: FISMA does not regulate companies directly. It reaches them because the agency head must secure contractor-operated systems, so requirements arrive through contract clauses, the agency's authorisation to operate (ATO) and, for cloud services, FedRAMP. See the FedRAMP Guide. Agencies and contractors that handle federal tax information must also meet the IRS Publication 1075 safeguards.
• State and local government: FISMA does not apply to states, although state programmes often borrow its NIST baseline. See the StateRAMP / GovRAMP Guide and the US State Cybersecurity Laws Map.

Key obligations

Section 3554(b) requires every agency to run an agency-wide information security program that includes eight elements. The table maps each to the NIST SP 800-53 Rev. 5 controls and NIST CSF 2.0 outcomes that auditors usually test against.

Section 3554(c) adds an annual report from each agency to OMB, DHS, the relevant congressional committees and GAO, covering major incidents, the total number of incidents and PII breaches with the number of individuals affected. Section 3555 adds the annual independent evaluation, which must test a representative subset of systems and assess the agency's overall policies and practices.

How the statute becomes specific requirements

• NIST standards: FIPS 199 categorises each system as low, moderate or high impact, FIPS 200 sets minimum requirements, SP 800-53 supplies the control catalogue and baselines, and SP 800-37 sets the Risk Management Framework that ends in an authorisation decision. See the NIST SP 800-53 Guide and the NIST Risk Management Framework (SP 800-37) Guide.
• OMB annual guidance: the most recent annual FISMA guidance memo is M-25-04, "Fiscal Year 2025 Guidance on Federal Information Security and Privacy Management Requirements" (15 January 2025), which rescinded M-24-04. It sets reporting deadlines, the major incident definition, CDM expectations (at least 90 per cent of government-furnished equipment reported through Continuous Diagnostics and Mitigation, including EDR coverage) and Zero Trust alignment.
• CISA directives: binding operational directives are compulsory for federal civilian executive branch agencies. Current examples include BOD 22-01 (known exploited vulnerabilities), BOD 23-01 (asset visibility and vulnerability detection), BOD 23-02 (internet-exposed management interfaces) and BOD 25-01 (secure practices for cloud services, 17 December 2024). Emergency directives such as ED 24-02 (nation-state compromise of Microsoft corporate email) address urgent threats.
• Other OMB memos: 2026 memos with direct security effect include M-26-05 on a risk-based approach to software and hardware security (23 January 2026), M-26-14 on agency logging and network visibility (22 May 2026) and M-26-15 on post-quantum cryptography migration (24 June 2026). See the Post-Quantum Cryptography Migration Guide.

Reporting cycle and the IG maturity model

The IG metrics evaluate ten domains grouped under the six CSF 2.0 functions: Cybersecurity Governance and Cybersecurity Supply Chain Risk Management (Govern), Risk and Asset Management (Identify), Configuration Management, Identity and Access Management, Data Protection and Privacy and Security Training (Protect), Information Security Continuous Monitoring (Detect), Incident Response (Respond) and Contingency Planning (Recover). Each is rated on five levels: Ad Hoc, Defined, Consistently Implemented, Managed and Measurable, and Optimized. Core metrics are assessed every year and the rest on a two-year cycle. Ratings default to a calculated average, but IGs apply judgement and must comment on any metric rated below Level 4. The FY2025 metrics (version 2.0, April 2025) noted a planned FY2026 review to align fully with CSF 2.0 and possibly add Zero Trust metrics; at least one FY2026 IG evaluation published in September 2026 stated that no changes were made to the metrics for FY2026.

Timeline and current status

Status as of 25 October 2026: FISMA 2014 remains the governing statute. OMB's published memoranda list for 2025 and 2026 shows no separate FY2026 FISMA guidance memo, so M-25-04 is the latest annual FISMA guidance we could confirm. Reform bills have been introduced in earlier Congresses to clarify OMB, CISA and National Cyber Director roles and update incident reporting, but we could not confirm any 2025 or 2026 reform bill that has advanced. Check OMB's memoranda page and CISA's FISMA metrics before each reporting cycle, because deadlines and metrics change annually.

Enforcement and penalties

FISMA has no fines and no private right of action. Enforcement works through oversight, budget and public accountability:

• OMB oversight and budget: the Director may enforce accountability for compliance (3553(a)) and ties FISMA performance to agency budget submissions; IG metrics are due in August partly so results can inform budgets.
• CISA directives: BODs and EDs are mandatory for civilian agencies, with reporting to CISA on completion; non-compliance is visible to OMB and in CyberScope data.
• Independent evaluation: an IG finding that a program is "not effective" goes to OMB and is summarised for Congress, and repeat findings appear in GAO reviews.
• Congressional notification: major incidents must be reported to Congress within 7 days, which triggers hearings and letters. The BeyondTrust breach at the US Treasury, where a stolen vendor API key gave remote access to departmental workstations, was declared a major incident and reported to lawmakers.
• Contractual consequences: for contractors, failure to meet the security terms of an ATO, FedRAMP authorisation or contract can mean loss of authorisation or contract remedies, outside FISMA itself.

What it means for AI agents and non-human identities

FISMA is technology neutral, but every element of 3554(b) applies to service accounts, API keys, workload identities and AI agents that act on agency systems. Two incidents show why. In the CISA Private-CISA GitHub leak, a contractor's public repository exposed AWS GovCloud administrative keys and plaintext passwords for about six months, and deleting the repository did not revoke the keys. In the Treasury incident, a single SaaS API key was the route in.

• AI agents: an agent with tool access is a non-human identity with delegated authority. Register it in the system inventory, give it its own credential, bound its permissions in the system security plan and log its actions as you would a privileged user. See the Identity Governance for AI Agents Guide.
• Secrets: replace long-lived cloud keys with federated, short-lived credentials and enforce push protection in code repositories. See the Secrets Management Guide and the Service Account Security Guide.

Compliance steps

1. Confirm scope: list every system the agency owns or a contractor operates for it, its FIPS 199 category and whether it is a national security system. Reconcile against CDM data, which M-25-04 expects to cover at least 90 per cent of government-furnished equipment.
2. Baseline against the IG metrics: self-assess each of the ten domains on the five-level scale using the current CISA IG metrics, and identify domains below Level 4.
3. Close directive gaps first: verify compliance with active BODs (KEV remediation, asset discovery, management interfaces, cloud configuration baselines under BOD 25-01), because these are mandatory and easy for an IG to test.
4. Fix the incident clock: write the major incident determination into the incident response plan with named decision-makers, the 100,000-record PII trigger, 1-hour notification to CISA and OMB, and the 7-day congressional notice. Rehearse it. See the Incident Response Plan Template.
5. Bring machine identities into the program: inventory NHIs, assign owners, rotate or retire long-lived keys and include them in access reviews and continuous monitoring.
6. Flow requirements to contractors: include incident reporting, credential handling and evidence requirements in contracts; use FedRAMP authorisations for cloud services.
7. Produce evidence continuously: automate control evidence (ISCM dashboards, POA&M ageing, MFA coverage) rather than collecting it once a year for the IG.
8. Track change: assign someone to watch OMB memoranda, CISA directives and the IG metrics each year, and update the program before the reporting cycle starts.

Metrics that show the program is working

• Domain maturity: number of IG domains at Level 4 or above, year on year.
• Asset coverage: percentage of endpoints visible through CDM, with EDR deployed.
• KEV remediation: percentage of KEV catalogue vulnerabilities fixed within BOD 22-01 deadlines.
• Notification timeliness: time from major incident determination to CISA and OMB notification (target under 1 hour).
• NHI hygiene: percentage of service accounts and API keys with a named owner and rotation within policy.
• POA&M ageing: number of overdue plans of action and milestones by system impact level.

Common failure patterns

• Treating FISMA as an annual paperwork exercise: agencies that collect evidence only for the IG rarely reach Level 4, which requires measured, consistently operating controls.
• Inventories that stop at hardware: software, cloud services and non-human identities missing from inventories leave the Identify and Protect domains weak and make incident scoping slow.
• Vendor credentials outside the program: SaaS and remote support integrations with standing keys, as in the Treasury incident, sit outside agency access reviews.
• Contractor shortcuts: disabled secret scanning and personal repositories, as in the CISA Private-CISA leak, expose high-privilege credentials for months.
• Unclear major incident ownership: without a named decision-maker, the 1-hour notification clock is missed while teams debate severity.
• Stale guidance: programs built around a rescinded memo or last year's metrics fail the current evaluation.

Practitioner checklist

• Map every system, including contractor-operated and cloud systems, with FIPS 199 category and ATO status.
• Self-assess the nine IG domains against the current CISA IG FISMA metrics and record gaps below Level 4.
• Confirm compliance with BOD 22-01, BOD 23-01, BOD 23-02 and BOD 25-01, with evidence.
• Document the major incident determination process, 1-hour CISA and OMB notification, and 7-day congressional notice.
• Add service accounts, API keys, certificates and AI agents to the inventory with owners and rotation dates.
• Replace long-lived cloud keys with federated, short-lived credentials where the platform allows.
• Write incident reporting and credential handling clauses into contractor agreements.
• Track POA&M ageing and KEV remediation monthly.
• Review OMB memoranda, CISA directives and IG metrics before each reporting cycle.

Standards and references

• US Code (LII): 44 U.S.C. 3554, Federal agency responsibilities
• US Code (LII): 44 U.S.C. 3553, Authority and functions of the Director and the Secretary
• US Code (LII): 44 U.S.C. 3555, Annual independent evaluation
• OMB: M-25-04, Fiscal Year 2025 Guidance on Federal Information Security and Privacy Management Requirements
• CISA: FY2025 Inspector General FISMA Reporting Metrics, Version 2.0
• CISA: Cybersecurity Directives
• OMB: Memoranda
• NIST: SP 800-53 Rev. 5

Related NHI Mgmt Group resources: FedRAMP Guide · NIST SP 800-53 Guide · CISA Zero Trust Maturity Model Guide · StateRAMP / GovRAMP Guide · Service Account Security Guide. This guide summarises the Federal Information Security Modernization Act of 2014 and related OMB and CISA guidance and is not legal advice.