What You Need to Know About Implementing a FISMA Data Center

If you are carrying out any sort of work for the federal government, there is a strong chance you need to keep the data in a FISMA data center. This means that you either need a private/collocated FISMA compliant data center or to use a public cloud service with a FISMA compliant data center.

The basics of a FISMA data center

FISMA started as the Federal Information Security Management Act (of 2002) and was then updated as part of the Federal Information Systems Modernization Act (of 2014). FISMA sets out cybersecurity standards for federal government agencies (including state agencies that administer federal programs). It, therefore, extends to any contractors that work in these sectors. Like FedRAMP, FISMA  rules are based on NIST SP 800-53.

On its own, a FISMA data center, is not sufficient for contractors involved in the Federal Information Security Management Act (of 2002). They need to have a CMMC (Cybersecurity Maturity Model Certification) data center. The CMMC certification is based on NIST SP 800-171 and NIST SP 800-172.

Being able to demonstrate that you run or use a FISMA compliant data center can also be a competitive advantage in other areas. For example, broader state and local agencies are likely to be reassured by evidence that a contractor is FISMA compliant. Similar comments apply to businesses and other private organizations handling sensitive data.

In fact, storing your data in a FISMA data center can be a very effective defensive measure against unwittingly falling foul of FISMA. Ignorance is unlikely to be an excuse here (even if it’s demonstrably true), especially not at the enterprise level.

The specific requirements of FISMA

Before you decide whether or not you want to run a FISMA data center, you will need to think about whether or not you realistically can. You will also need to think about whether you can commit the necessary resources to completing the annual evaluations required of FISMA compliant data centers. These must be conducted by either an external auditor or the agency Inspector General.

Unfortunately, there is no one-size-fits-all approach to creating a FISMA data center. Even if there were, it would probably be continually updated to reflect the ever-changing nature of IT threats. As it is, running a FISMA data center essentially means being able to demonstrate that you can capably manage key areas of cybersecurity.

Information system inventory

You can only protect something if you know you have it. FISMA, therefore, requires contractors to create and maintain an accurate inventory of all the systems used in its work for the federal government. This should include the boundaries of and connections between different system components.

Develop a risk assessment plan

A FISMA data center does not need to apply the very highest levels of data security to all federal data. It simply needs to apply an appropriate level of data security for the threat posed to the data. To do this, it needs an effective strategy for assessing risk.

Assess and categorize risk levels effectively

This is essentially a corollary of the previous point. It’s not enough just to have a strategy for assessing risk effectively, you need to be able to apply it. That means you need to ensure that there is somebody who takes overall responsibility for making sure that it happens. You also need to ensure that the person has sufficient resources to do their job effectively.

Develop a plan for system security

Similar comments apply here. In the real world, a security breach occurs when somebody finds a crack in an organization’s security defenses. The more disjointed an organization’s security defenses are, the likelier it is that an attacker will be able to find a point of entry.

It, therefore, follows that the most effective security controls are driven by an overarching, holistic security plan. This is what FISMA requires.

Follow NIST guidelines and implement NIST controls

FISMA is underpinned by NIST SP 800-53 but businesses should follow any relevant NIST guidelines and implement any relevant NIST controls.

Certify and accredit any new IT system, software, assets, or hardware

Security systems are only as strong as their individual components. That means any component introduced to a FISMA data center has to be proven to be able to meet a suitable standard of security.

Continuously monitor security controls and systems

This is standard in any form of security compliance program including other programs run by the federal government (e.g. CMMC and FedRAMP). Businesses must stay aware of developing threats and update their systems to cope with them.

Related Resources:

What You Need To Know About GDPR Colocation
What You Need To Know About HIPAA Colocation
Hybrid IT Security: Safeguarding Your Business
What you need to know about managed disaster recovery services
Private Infrastructure as a Service (IaaS): What You Need to Know
What You Need to Know About the Cloud for Retail: Enhancing Customer Experiences
Choosing an IT Disaster Recovery Solution: Key Factors to Consider
Who Needs To Be FISMA Compliant?
Why Are Cybercrimes On The Rise?