Requirements & evidence
FISMA
The Federal Information Security Modernization Act of 2014 — the statutory authority a federal RFP names, implemented operationally through NIST SP 800-53 and the NIST Cybersecurity Framework, both already tracked as their own registry entries.
- Edition on record
- Federal Information Security Modernization Act of 2014
- Edition published
- Source last checked
Understand the scope
What the framework covers.
The library records this framework for federal, federal contractors, across US. The issuing authority determines applicability; your assessment scope should identify the organization, systems, services, and edition being assessed.
Areas of requirement
- Agency information security programs
- OMB oversight
- Annual independent evaluation
- Incident reporting
The library tracks the authority and edition. A normalized requirement catalog is not available for this framework, so a requirement count is not stated here.
Prepare with context
The evidence behind
the requirements.
Evidence needs to demonstrate how a requirement is met within the assessment scope. Keep the source requirement, collection context, responsible owner, review decision, and period of applicability together.
A framework-specific collection workflow has not been activated. The reference material on this page can inform scoping and preparation; it does not establish evidence collection or assessment readiness.
ControlFrame availability
Framework reference available
Authority and version facts, with a parsed public catalog when available; no tenant blueprint or executable evidence method is activated.
How availability is determined
FISMA is tracked in the registry — authority, version ledger, verification — and nothing else is modelled for it yet. Import its catalog to begin.
Catalog status: Planned. Tracked metadata: we record the regime and its issuing authority for review. Registry presence does not mean automated monitoring is active. No control or requirement model is implemented.
Statutory authority only; implemented through NIST SP 800-53 and the NIST Cybersecurity Framework, both already tracked separately. No FISMA-specific control catalog exists to ingest.
Follow the source
Editions and transitions.
These are the editions recorded in the library, checked September 6, 2026. Confirm the applicable edition with the authority before beginning an assessment.
Announced transition
No modernization bill has passed since 2014. A 2023 reform bill advanced through Senate committee markup but did not become law; no equivalent bill has been tracked in the current Congress as of this check.
Authority’s stated timing: No pending legislation identified
Read the authority’s announcement (opens in a new tab)- Federal Information Security Modernization Act of 2014Current edition on record · Replaces Federal Information Security Management Act of 2002
- Federal Information Security Management Act of 2002Superseded edition
Recorded change history
· FISMA Federal Information Security Modernization Act of 2014 supersedes Federal Information Security Management Act of 2002 and is the current edition.
Check the basis
Sources you can follow.
Corroborated through independent sources; direct verification with the authority was unavailable. Source verification was recorded on September 6, 2026.
- Cybersecurity and Infrastructure Security Agency (opens in a new tab)
Issuing authority and framework publication.
Catalog provenance and record details
Framework record: fisma-2014.
Source artifact: acquisition required.
Parsed catalog: Not ingested.
Control families as published: Agency information security programs · OMB oversight · Annual independent evaluation · Incident reporting.
Record last updated: September 6, 2026.
Common questions
A closer look.
What is FISMA?
The Federal Information Security Modernization Act of 2014 — the statutory authority a federal RFP names, implemented operationally through NIST SP 800-53 and the NIST Cybersecurity Framework, both already tracked as their own registry entries.
Who does FISMA apply to?
FISMA applies to federal, federal contractors, US, per Cybersecurity and Infrastructure Security Agency.
What is the current version of FISMA?
The current edition is Federal Information Security Modernization Act of 2014, issued by Cybersecurity and Infrastructure Security Agency and published 2014-12-18. Source: https://www.cisa.gov/topics/cyber-threats-and-advisories/federal-information-security-modernization-act.
What does an assessment under FISMA require?
No control catalog has been ingested for FISMA yet — the registry tracks it as planned (Tracked metadata: we record the regime and its issuing authority for review. Registry presence does not mean automated monitoring is active. No control or requirement model is implemented), so an assessment under this framework currently requires the authority's own catalog rather than a ControlFrame-parsed one.
At a glance
FISMA
Federal Information Security Modernization Act of 2014
- Framework reference
- Authority and edition tracked
- Evidence preparation
- Framework reference available
- Source confidence
- Independent corroboration
A framework reference describes requirements. Evidence decisions belong to a scoped assessment and a named reviewer.
Make the requirements
part of the work.
Explore how ControlFrame can organize FISMA requirements, evidence preparation, and review for your assessment scope.