OMB Guidance Heralds Automation of FISMA Reporting

The Office of Management and Budget plans to develop a strategy that will enable agencies to automatically fulfill reporting requirements under the Federal Information Security Modernization Act.

“FISMA data collection has long remained an overly manual process that often leads agencies to create complicated spreadsheets and internal processes to respond to questions,” reads the guidance released by the White House Monday. “As the Federal information security apparatus matures, so should its reporting mechanisms. OMB is emphasizing automation and the use of machine-readable data to speed up reporting, reduce agency burden, and improve outcomes. This memorandum directs development of a strategy to enable agencies to report performance and incident data in an automated and machine-readable manner.” 

The new FISMA guidance comes amid a landmark executive order on improving cybersecurity through increased visibility and the recognition of a need to focus agency reports on priority areas.  

“As federal agencies face ever more sophisticated attempts to compromise government systems, it is vital that agency security efforts are focused on making it demonstrably harder for our adversaries to succeed,” said Federal Chief Information Security Officer Chris DeRusha. “OMB’s updated FISMA guidance is designed to help agencies focus on practical security outcomes by measuring the use of rigorous multi-layered security testing, automation of security and compliance controls, and progress in adopting a zero trust architecture.” 

In October, DeRusha told Nextgov he was thinking of revising the timelines for FISMA reporting in order to allow agencies to do a better job on areas that really matter, such as penetration testing. 

In the new guidance, OMB encouraged agencies to shift to a continuous assessment process and flagged changes coming to the reporting timelines.

“To help facilitate this, OMB and [the Council of the Inspectors General on Integrity and Efficiency] are transitioning the IG metrics process to a multi-year cycle,” the guidance reads. “OMB will select a core group of metrics, representing a combination of administration priorities and other highly valuable controls, that must be evaluated annually. The remainder of the standards and controls will be evaluated in metrics on a two-year cycle based on a calendar agreed to by CIGIE, the CISO Council, OMB, and CISA. These changes do not in any way limit the scope of IG authority to evaluate information systems on an as-needed or ad-hoc basis.”

Other highlights from the guidance surround actions agencies must take regarding the Continuous Diagnostics and Mitigation program run by the Department of Homeland Security. CDM facilitates the visibility stressed in the executive order by allowing officials to see assets, users and activities across the federal enterprise through a central dashboard. It does this in part by providing procurement vehicles that can also help agencies save money on cybersecurity tools and if agencies aren’t using those resources, OMB wants to know why.

“A justification should be provided from the agency CISO to the CDM PMO, the relevant OMB Resource Management Officer, and the OMB Office of the Federal Chief Information Officer for each contract period of performance to ensure existing tools keep pace with CDM contract vehicle tools,” the guidance reads.

Further, the guidance requires agencies to work with the OMB resource management officer to create spending plans detailing the resources being dedicated to CDM. 

“Agencies shall, in coordination with their RMO, build CDM requirements into budget plans in future years,” the guidance reads, noting, “For non-CFO Act agencies that are unable to pay for CDM, the CDM PMO will cover all costs.”