What is FISMA Compliance?

Kent Yunk

February 17, 2019

Security and compliance should never be an afterthought, especially when it comes to something as sensitive as data management.

With today’s cybersecurity threats maintaining online security is beyond important. Especially, if your business provides essential services to federal agencies, or you’re operating within the government yourself.

FISMA seeks to provide protocols for proper information security management. Beyond knowing they exist, you need to know how to implement the latest regulations into your business.

Below we discuss what FISMA compliance means for your business, why the act came into existence, and finally how you can upgrade your security practices to reflect the latest security standards.

What is FISMA?

FISMA stands for the Federal Information Security Modernization Act. It was passed in 2002 and has currently been updated in 2014 to reflect the latest federal information security standards.

Overall, it introduced requirements for federal agencies to create, document, and implement information security protection programs. It helps to create a set of security guidelines and reduce overall security risk. FISMA introduces a set of standards that your business or federal agency must meet.

The scope of FISMA is actually quite large and extends to businesses who have contracts or provide services to the federal government, and even to government programs such as Medicare.

Failure to comply with FISMA requirements can lead to steep fines, or existing contracts being voided. Still, achieving compliance can be difficult if you don’t know what you’re trying to meet.

Luckily, companies like 8x8 make compliance easy, as you’ll learn below.

Why Was it Started?

But first, why does FISMA exist in the first place?

FISMA has existed since 2002, making it over a decade old. We all know that the security risks of yesterday pale in comparison to the security risks of today. Still, agencies and related companies have been slow to adopt and implement the requirements of FISMA until recently.

The intention behind the act was to help modernize and create an actionable security framework for contractors working with the federal government, along with certain federal programs.

The latest update to FISMA in 2014 has amended and renamed the act as the Federal Information Security Modernization Act. With the increased reliance upon third-party contractors and companies this adoption has now become a strict mandate.

The National Institute of Standards and Technology (NIST) has been instrumental in the creation of the security standards put forth in FISMA and continues to assist with regulation updates and even enforcement.

What FISMA Compliance Means for Your Technology Company

Achieving FISMA compliance can be a great thing for your organization.

When you’re bidding for jobs having a high level of security compliance gives you a competitive advantage against companies who have less strict standards. When you’re dealing with extremely sensitive information those with the highest levels of security measures in place will get more jobs.

Plus, holding your business to the latest FISMA standards isn’t only good for the federal agencies you’re working with, but it’s good for the future of your business. Having a security breach can lead to serious damage, which you may not be able to recover from.

Not only that, but you lessen the risk of a FISMA audit. Failing to adhere to the FISMA requirements could lead to consequences like:

Deduction in your overall award fees
Reduction in your budget (if you’re a federal agency)
Non-compliance can be made public (leading to a loss of competitiveness)

Want to remain compliant? Learn about the most important compliance requirements below:

FISMA Compliance Requirements

To achieve FISMA compliance there are certain security standards you’ll need to meet. Here’s the basic process you’ll need to follow:

Categorize all information that needs to be secured.
Set baseline levels of control and assess various forms of risk.
Create a system security plan that documents your controls.
Implement the controls defined in your system security plan.
Assess the effectiveness of your security system.
Determine ongoing levels of risk.
Continuously refine and monitor your information security plan.

Let’s look at a few of these compliance requirements in greater depth:

System security plan and protocols in place. How are you keeping your security standards? You must keep a detailed plan of what security controls and policies you have in place, along with how this plan is being implemented.
Keep an ongoing information system inventory. Think of this as a map of your existing information security inventory. You must keep records of all information systems currently being utilized, along with any integrations between software and networks that exist. This includes your contact management or communication software.
Categorize your levels of risk. You must determine and classify your levels of security risk for the various information systems you’re employing and the types of information you're dealing with.
Conduct risk assessments. Regular risk assessments should be conducted in accordance with the NIST guidelines. Regular assessments will help to reduce your risk of a damaging audit. This can be done in-house, or by hiring a third-party provider.
Implement security controls. There are a variety of different security controls you can implement according to the provided FISMA guidelines. You don’t have to implement every recommended control, but ones that are relevant to your business.

Remember, compliance today isn’t just an exercise in filling out the right forms. It’s a compressive plan to change the way you handle your information security standards.

8x8 Makes FISMA Compliance Easier

Achieving and maintaining FISMA compliance is important. Implementing information security programs throughout your organization will take time, but it’s time well spent. Avoiding any penalties will help to ensure your reputation and existing contracts remain intact.

As you’re implementing and upgrading your security practices to reflect the latest standards the last thing you want is your VoIP or contact center provider to open you to risk. At 8x8 our virtual office and contact center solutions are fully FISMA compliant via third-party validation.

When it comes to security, 8x8 provides reliable and compliant cloud solutions at a demanding level rarely seen by other cloud providers. Don't take your chances with a subpar cloud-based telecom system. Call 1-866-879-8647 or fill ou the form below to speak with an 8x8 Product Specialist.