Call us now:
Ted Dziekanowski we have written many times of the role FISMA plays in U.S cybersecurity. Alongside OMB A-130 it forms the foundation of U.S cyber regulation. (https://lnkd.in/dVdM3ZRq)
FIMSA defines the framework for U.S Federal cyber compliance, that has in largely been ignored by Federal Agencies. But one suspects this is changing. Recently the DHS made clear that FISMA was the foundation from which its cybersecuirty compliance programs are based. The SEC publishes its annual FISMA compliance report demonstrating ‘it eats it’s own dog food’, as it moves towards a final cyber regulation for capital markets.
Updating FISMA to address cyber incident reporting embeds cyber requirements into U.S regulation. But what is missed is that introducing incident reporting is not what matters. FISMA formalizes ‘Left of Bang’ cyber through risk management, cybersecurity standards and profiles for the management of cybersecurity for Federal Agencies. These are defensive requirements for the protection of Federal data and information, incident reporting is simply ‘Right of bang’ reporting that is required when ‘Left of Bang’ prevention has failed.
Stephen Pitt-Walker, JD, FGIA Rachel V. Rose, JD, MBA
#cybersecurity #cyberriskmanagement #cyberlaw #fisma
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3AgroupPost%3A8837399-7086305006261260288