FISMA vs. FedRAMP and NIST: Making Sense of Government Compliance Standards

FISMA, FedRAMP, NIST, DFARS, CJIS, HIPAA … Government compliance standards can seem like a veritable alphabet soup. Making matters even worse, a lot of them overlap, and many organizations aren’t certain which standards they need to comply with.

Even if your organization does not currently operate in the public sector, it is important to understand the fundamentals of FISMA, FedRAMP, and NIST. First, the U.S. government is the single largest buyer of goods and services in the world, and your company may ultimately want to tap this lucrative market. Second, any information security standards that the federal government implements will ultimately trickle down into state and local laws, as well as industry frameworks.

What is NIST?

The National Institute of Standards and Technology (NIST) is a non-regulatory agency that is part of the United States Department of Commerce. Its mission is “To promote U.S. innovation and industrial competitiveness by advancing measurement science, standards, and technology in ways that enhance economic security and improve our quality of life.”

Among many other responsibilities, NIST creates and promotes information security standards for the federal government. These standards are outlined in NIST’s SP-800 series of publications, including NIST SP 800-53 (also known as NIST 800-53), which outlines security controls for federal information systems and organizations and documents security controls for all federal information systems, except those designed for national security. Federal agencies must comply with NIST guidelines and standards within one year of their publication.

The controls outlined in NIST 800-53 are the basis for FISMA as well as FedRAMP, DFARS, CJIS, HIPAA, FedRAMP +, FedRAMP DoD IL 2, 4, 5, 6 and others.

What is FISMA?

FISMA was first enacted in 2002 as the Federal Information Security Management Act, then updated in 2014 to the Federal Information Security Modernization Act. FISMA applies to:

• All federal government agencies
• State agencies that administer federal programs, such as Medicare/Medicaid and student loans
• All private-sector firms that support federal programs, sell services to the federal government, or receive federal grant money

In a nutshell, FISMA requires the implementation of information security controls that utilize a risk-based approach. The primary framework for FISMA compliance is NIST 800-53. Organizations that demonstrate FISMA compliance are awarded an Authority to Operate (ATO) from the federal agency they are doing business with. This ATO applies only to that particular agency; if an organization has contracts with multiple federal agencies, they must obtain an ATO from each one. The logic behind this is that because every federal agency has different data security needs and vulnerabilities, different controls may apply. A FISMA assessment may be performed directly by the agency granting the ATO or a third-party security assessor.

What is FedRAMP?

The Federal Risk and Authorization Management Program (FedRAMP) was designed to support the federal government’s “cloud-first” initiative by making it easier for federal agencies to contract with cloud providers. Like FISMA, the controls outlined in FedRAMP are based on NIST 800-53.

Unlike FISMA, which requires organizations to seek an ATO from each individual federal agency, a FedRAMP ATO qualifies a cloud service provider to do business with any federal agency. Because FedRAMP ATO’s are more far-reaching, the certification process is far more rigorous. It must also be performed by a certified third-party assessment organization (3PAO) such as Lazarus Alliance. Finally, FedRAMP is more specific than FISMA. FISMA applies to information systems security in general, while FedRAMP applies only to cloud service providers and federal agencies that plan to use cloud service providers.

Since the FedRAMP certification process is so demanding, a FedRAMP ATO is beneficial even for cloud service providers that do not currently work with the federal government. Private-sector companies are aware of how difficult it is to comply with FedRAMP and recognize it as a gold standard of cloud security.

However, this is not to say the FISMA compliance process is “easy.” Organizations need to map the specific NIST 800-53 controls to the FISMA requirements of each agency they wish to do business with. There are hundreds of different controls, and figuring out which ones apply in each situation can be quite complex.

Complying with FedRAMP, FISMA, and NIST 800-53

Regardless of which compliance framework is right for your organization, it’s best to partner with a certified 3PAO such as Lazarus Alliance. Our FISMA and FedRAMP Cybervisors™ will provide your decision-makers with a clear picture of certification costs, timelines, and internal resource demands to facilitate an informed decision about pursuing FedRAMP or FISMA certification based on NIST 800-53.

Further, by leveraging Continuum GRC’s proprietary IT Audit Machine, a revolutionary GRC software package that utilizes pre-loaded, drag-and-drop modules, Lazarus Alliance takes the pain and high costs out of the FedRAMP and FISMA compliance process. Some of our clients have saved up to 1,000% over traditional FedRAMP assessment methods.

The cyber security experts at Lazarus Alliance have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cyber security®. Call +1 (888) 896-7580 to discuss your organization’s cyber security needs and find out how we can help your organization adhere to cyber security regulations, maintain compliance, and secure your systems.

Governance, risk, and compliance should be at the heart of AWS security procedures

Another day, another AWS security breach, and this one is particularly bad because of the extraordinarily sensitive nature of the data that was compromised: Over 9,000 documents containing personal data on job applicants holding U.S. security clearances, some of them Top Secret, were discovered sitting on an insecure AWS S3 bucket, where they may have been for as long as a year. Gizmodo reports:

[T]he cache of roughly 9,400 documents reveal extraordinary details about thousands of individuals who were formerly and may be currently employed by the US Department of Defense and within the US intelligence community.

Other documents reveal sensitive and personal details about Iraqi and Afghan nationals who have cooperated and worked alongside US military forces in their home countries, according to the security firm who discovered and reviewed the documents. Between 15 and 20 applicants reportedly meet this criteria.

The AWS bucket belonged to a company called TalentPen, a third-party vendor hired by private security firm Tiger Swan to process job applications.

Sound GRC Can Prevent AWS Security Breaches

The TalentPen breach is only the latest in a long line of AWS security incidents, most of them involving third-party business associates of larger firms, such as Verizon and the Republican National Committee. The problem is so pervasive that Amazon itself recently sent out a mass email to customers with unprotected AWS S3 buckets, imploring them to review their security settings, and many companies are now questioning how secure the AWS service really is.

However, the problem isn’t with Amazon Web Services. AWS security is quite sound – if it is configured correctly, and if the enterprise using it follows sound GRC practices and applies them to on-premises data, data residing in the cloud, and, in the case of the companies hiring IT service providers, data being handled by those service providers.

It’s Your Data, and You’re the One Who Has to Secure It and Maintain Compliance

While AWS offers security protections such as encryption of PII both at rest and in transit, and AWS S3 buckets are set to private by default, these protections are only as good as the company that’s utilizing AWS. In the Verizon, RNC, TalentPen, and other recent breaches, someone went into the system and took specific steps to override the default AWS settings and open the buckets up for public viewing.

This raises very serious questions regarding data security and governance within these organizations. Who went into the AWS accounts and made these buckets public? Why did they do this? Why did they have the system privileges to access this data and make this change, and why did the change go unnoticed (in the case of TalentPen, perhaps for as long as a year)? Why was data this sensitive uploaded to the cloud in the first place? Comprehensive, consistent cloud security and AWS security protocols, combined with appropriate user access credentials and continuous system monitoring, would have prevented all of these breaches.

Compliance is another issue when using AWS or other cloud services. While AWS contains tools that customers can use to ensure they comply with major IT audit frameworks, such as HIPPA, PCI DSS, NIST, and FISMA, it would be impossible for AWS, or any other provider, to ensure that all of their customers are covering every aspect of the specific compliance requirements that apply to them. Thus, AWS operates on a “shared responsibility” model, where AWS itself is responsible for the security and compliance of their cloud, while their customers are responsible for the security of the data they store within it.

In the end, it is your data, and you are the one who is ultimately responsible for it – even if a third-party vendor is the one who mishandles it.

Addressing governance, risk, and compliance in the cloud and throughout your cyber ecosystem can be a challenge, but in the end, proactive GRC is much less expensive than cleaning up after a data breach.

The cyber security experts at Lazarus Alliance have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cyber security®. Call 1-888-896-7580 to discuss your organization’s cyber security needs and find out how we can help your organization adhere to cyber security regulations, maintain compliance, and secure your systems.

New Anthem breach underscores the need to manage cyber risk throughout the enterprise ecosystem

Anthem – yes, that Anthem – has been hacked again. About a month after the beleaguered health insurer agreed to fork over a record-setting $115 million to settle a class action lawsuit related to its massive 2015 breach, it was breached again, or rather, one of its third-party vendors was. The 2017 Anthem breach involves approximately 18,000 Medicare members whose personal information was stolen by a malicious insider employed by LaunchPoint Ventures, a Medicare insurance coordination services firm. Healthcare IT News reports:

LaunchPoint discovered on April 12 that an employee was likely stealing and misusing Anthem and non-Anthem data. The employee emailed a file containing information about Anthem’s members to his personal address on July 8, 2016.

The file contained Medicare ID numbers, including Social Security numbers, Health Plan ID numbers, names and dates of enrollment. Officials said limited last names and dates of birth were included.

Takeaways from the Latest Anthem Breach

The Anthem breach is the latest to underscore the need for organizations to manage cyber risk throughout their entire enterprise ecosystem. Anthem’s own systems weren’t hacked; their third-party vendor was. Other recent victims of third-party breaches include Netflix, the Republican National Committee, Trump Hotels, Verizon, and Google (which was impacted by a breach at third-party vendor of one of their third-party vendors).

As organizations outsource more and more IT services, from payroll to billing to web development, hackers are increasingly targeting these service providers. It is estimated that 63% of all enterprise breaches can be traced back to a third-party vendor. Hackers may choose to attack these service providers because many of them are smaller firms whose cyber security may not be as robust as that of the national or multinational corporation whose data they really want.

Know Your Vendors

The danger of third-party data breaches is one of the reasons why the U.S. Department of Defense is requiring not only its primary contractors, but any firm they subcontract DoD work to, to be compliant with the DFARS security standard by the end of 2017.

Private-sector organizations should take a cue from the DoD and only do business with IT service providers who have released AICPA SOC / SSAE16 reports and/or who have important IT security certifications such as NIST, ISO, or FedRAMP. These organizations have proven their commitment to the highest levels of data security by undergoing rigorous security audits that require them to adhere to certain procedures and controls and put them in writing.

Likewise, IT service providers should obtain the appropriate data security certifications and demonstrate to their customers that they have strong security controls in place. Continuum GRC’s IT Audit Machine (ITAM) empowers organizations to get and maintain compliance the easy way, with self-help modules covering numerous compliance standards, including FedRAMP, SSAE 16, COBIT, ISO 27001, ISO 27002, ISO 27005, SOX, FFIEC, PCI, GLBA, HIPAA, CMS, NERC CIP, DFARS, and other federal and state mandates.

Don’t Expect to Pass the Buck

Just because a breach is your vendor’s fault doesn’t mean your organization will be shielded from liability. The $300 million Target breach, which resulted in both the CEO and the CISO losing their jobs, involved a third-party point-of-sale vendor.

The scope of potential liability just broadened; shortly after news of the Anthem breach broke, a U.S. Court of Appeals issued a ruling against health insurer CareFirst, allowing a class-action lawsuit filed by customers impacted by a 2014 breach to move forward. The ruling is expected to have wide implications, allowing customers not only of health insurers but any company to sue if their personal information is stolen.

Ensuring good governance, risk management, compliance, and cyber security throughout your enterprise ecosystem takes far less time and costs far less money than doing damage control after a breach happens.

The cyber security experts at Lazarus Alliance have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cyber security®. Call 1-888-896-7580 to discuss your organization’s cyber security needs and find out how we can help your organization adhere to cyber security regulations, maintain compliance, and secure your systems.