Can agency systems handle new FISMA requirements?

New standards released today by the White House for reporting under the Federal Information Security Management Act will require agencies to shift from paper-based annual reports to real time data feeds of system status that will be correlated by the Homeland Security Department.

The new requirements are an effort to shift agencies away from paper-based compliance system to real-time visibility, and shift investments from recordkeeping to automated security systems.

“Agencies will not spend all of their energy to generate reports,” federal Chief Information Officer Vivek Kundra told reporters during a press briefing today. The first agencies will begin reporting under the new requirements as early as June.

Although the requirements are intended to be met using existing commercial security products, not all agencies have adequate systems in place. “Some agencies are going to have to make investment to get their tools in place,” Kundra said.

However, one goal of the program is to allow agencies to shift millions of dollars now spent producing reports to acquiring automated systems.

A key component of the new requirement, CyberScope, already is in place in DHS to begin receiving and analyzing data feeds.

FISMA is an eight-year-old law that sets the statutory requirements for information security in executive branch agencies and has been criticized because of the focus on regulatory compliance and snapshot-based reporting that can cost millions of dollars without dealing with up-to-date vulnerabilities. Security best practices have been moving in the direction of real-time monitoring of systems and addressing high-priority vulnerabilities and threats rather than meeting static goals. The memoranda issued today by the Office of Management and Budget moves FISMA in that direction.

“Annual reporting is statutory under FISMA,” Kundra said. “We’ll still have that report, but it will be derivative of the monitoring.”

“Agencies need to be able to continuously monitor security-related information from across the enterprise in a manageable and actionable way,” the memo said. “To do this, agencies need to automate security-related activities, to the extent possible, and acquire tools that correlate and analyze security-related information.”

The memo outlines a three-tiered approach to FISMA reporting through CyberScope for fiscal 2010, due November 15:

• Data feeds directly from security management tools to DHS to enable a view of both agency-specific status and also visibility into the entire .gov enterprise.
• Governmentwide benchmarking on security posture to identify best practices and what areas need to be strengthened.
• Agency-specific interviews to develop the specific requirements for agencies with differing missions and risk levels.

The three-tiered approach was developed by a task force of government, private sector and academic experts that developed outcome-focused metrics.

CyberScope is the platform for all FISMA submissions and no submissions will be accepted outside of CyberScope. Agency CIOs, inspectors general and privacy officials all will report through this platform, and training on its use is being organized. Kundra said meetings with agencies on the use of CyberScope will begin May 7.

“Agencies should not build separate systems for reporting,” the memo said. “Any reporting should be a by-product of agencies’ continuous monitoring programs and security management tools.” Agencies not yet able to report directly from their security management tools will provide the information through an Excel template as an XML upload.

Quarterly reporting on key metrics already is required on a quarterly basis, and those reports will go through CyberScope beginning in June. Beginning in 2011 reports will become monthly.

White House Cybersecurity Coordinator Howard Schmidt, who helped to develop the new requirements, said they are an effort to “establish a first line of defense against today’s immediate threats.”

Schmidt said he has been working closely with legislators on Capitol Hill, where a number of cybersecurity bills amending FISMA have been introduced, to ensure that new requirements jibe with their intentions. He said the initial response to the new requirements has been positive.

DHS already has been named as the lead department in ensuring the government’s civilian IT infrastructure, while the National Security Agency has responsibility for the military and intelligence communities. The new requirements and the use of CyberScope as a mandatory platform for providing information will give the department a stronger role in that area.

“The Department of Homeland Security will provide additional operational support to federal agencies in securing federal systems,” the memo said. “DHS will monitor and report agency progress to ensure the effective implementation of this guidance.”

FISMA requirements apply only to civilian executive branch agencies, and the new reporting standards will apply only to the .GOV domain and not national security systems in the military and intelligence communities. Schmidt said the Defense Department is looking at incorporating CyberScope into its systems.