What is the Difference between FISMA and FedRAMP?

With its cloud-first policy, the U.S. government has committed to granting agencies broader authority to adopt commercially available cloud-based services. The top drivers of this adoption are improving return on investment, or ROI, for agency IT infrastructure investments, bolstering government IT security, and providing higher-quality services to the American people.

According to Gartner, in mid-2018, nearly half of government organizations were already actively using cloud services. Adoption is on the upswing, with hybrid cloud and multi-cloud offerings growing in prominence. If you plan to deliver cloud-based services to the government, it’s more important than ever to fundamentally understand government-enacted federal IT compliance standards. Two important IT security-related compliance mandates that get discussed a lot when talking about federal IT infrastructure are FISMA and FedRAMP.

FISMA and FedRAMP have the same high-level goals of protecting government data and reducing information security risk within federal information systems. Both are also built on the foundation of NIST Special Publication 800-53A controls. However, there is a distinct contrast between the two in terms of federal policy, security controls and authorization.

What Is FISMA?

Enacted in 2002, FISMA – the Federal Information Security Management Act – covers the compliance parameters on storage and processing of government data. It requires federal agencies and their private-sector vendors to implement information security controls that ensure data security postures of federal information systems are protected. All private-sector firms that sell services to the federal government must comply with FISMA requirements.

The primary framework for FISMA compliance is NIST SP 800-53. Put simply, for vendors to become FISMA-compliant, they must implement recommended information security controls for federal information systems as identified in the NIST SP 800-53. FISMA assessments are traditionally focused on information systems that support a single agency.

FISMA-compliant vendors receive Authority to Operate, or ATO, only from the particular federal agency with which they are doing business. If a vendor has business contracts with multiple federal agencies, the vendor must obtain ATO from each agency because security controls may differ in accordance with the specific data security needs of each agency.

Let’s Talk About FedRAMP

By enacting FedRAMP, the government aimed to make the cloud service provider procurement process easier on agencies. On the most basic level, FedRAMP is aimed more specifically at cloud service providers. Systems evaluated under FedRAMP for use by government agencies are commercial cloud-based systems (e.g., IaaS, PaaS, SaaS) used by private-sector enterprises.

Information systems evaluated under either FISMA or FedRAMP are categorized in accordance with FIPS 199 as high, moderate, or low based on a few different criteria. Then, based on the security categorization, applicable security controls from NIST SP 800-53 are applied to the information system as high impact, moderate impact or low impact. FedRAMP requirements include additional controls above the standard NIST baseline controls in NIST SP 800-53 Revision 4. These additional controls address the unique elements of cloud computing to ensure all federal data is secure in cloud environments.

Federal agencies know a cloud-based service is safe to use once it’s awarded the FedRAMP stamp of approval, and unlike FISMA, FedRAMP ATO qualifies a cloud service provider to do business with any federal agency.

Due to its wider scope, the FedRAMP certification process is also far more rigorous. The authorization program requires cloud providers to undergo an independent security assessment conducted by a third-party assessment organization, or 3PAO, to sell government cloud services to federal agencies.

Conclusion

Federal agencies looking for a FedRAMP-compliant product or service will likely also expect it to be FISMA-compliant. Cloud service providers should comply with both FISMA and FedRAMP regulations to maintain an ATO from the U.S. government. 

National and federal government departments worldwide count on Palo Alto Networks to prevent successful cyberattacks, safeguard classified and sensitive data and optimize security operations. 

Learn more