FISMA vs. FedRAMP
by Sarah Harvey / October 20th, 2020
FISMA and FedRAMP audits are often confused because both involve compliance around government data. But, when you dive into the details of each audit, you’ll recognize the differences are stark. Let’s talk through each of these compliance audits and how you can tell them apart from one another.
What is FISMA?
The Federal Information Security Modernization Act, or FISMA, is U.S. legislation that requires government agencies to meet a standard of processes and system controls that protects the confidentiality, integrity, and availability of their systems. The implementation of these processes must align with the NIST standards such as NIST SP 800-53, NIST SP 800-171, FIPS 199, and FIPS 200. All government agencies and their contractors are required to implement an information security program that complies with these established NIST standards under FISMA.
What is FedRAMP?
The Federal Risk and Authorization Management Program, or FedRAMP, standardizes the security practices of cloud solutions to comply with information security best practices. The goal of this audit is to provide a standard that cloud service providers (rather than government agencies) can check against to ensure their security practices measure up to governmental security needs. Continuous monitoring and automation are a focus of FedRAMP in an effort to increase cloud security and protection of government data for cloud service providers.
Comparing FISMA and FedRAMP
When you’re deciding which framework best fits your organization, it’s easy to get lost in the security talk. To help you determine whether you should engage in a FISMA or FedRAMP audit, we put together the most important differences between the two audits:
| FISMA | FedRAMP | |
| Who Needs It | All government agencies, departments, and vendors | Cloud service providers that host and protect government data |
| Who Can Perform the Audit | Any third party security assessor | A certified Third Party Assessment Organization (3PAO) |
| Number of Controls in Each of the Three Compliance Levels | Low: 124
Medium: 261 High: 343 | Low: 125
Medium: 326 High: 421 |
| Authorization Process | Annual reviews of reporting and current information security program | “Do Once, Use Many Times” authorization by the government, which is then reviewed by agencies |
If you’re a cloud service provider focused on compliance for protecting government data, there’s a chance you’d benefit from both a FISMA and FedRAMP audit. Upon receiving a FISMA or FedRAMP certification, cloud service providers must obtain and maintain an Authority to Operate, or ATO, from a federal agency. Both FISMA and FedRAMP have different ATO variations – JAB P-ATO and FedRAMP ATO – which are required by federal agencies to engage in business with vendors.
These differences and complexities can seem overwhelming, but they don’t have to stop you from starting your compliance journey. At KirkpatrickPrice, we partner with you to ensure the scope of your engagement and audit framework align with your compliance goals. Contact us today, to learn more about FISMA or FedRAMP and how we can help you start your audit journey.
