What legislation requires federal agencies to develop an agency-wide information security program?

What legislation requires federal agencies to develop an agency-wide information security program?

• A. E-Government Act of 2002, Section 208
• B. Federal Information Security Management Act (FISMA)
• C. Government Information Security Reform Act (GISRA)
• D. Clinger-Cohen Act

Answer: (B)

The Federal Information Security Management Act (FISMA) is the correct answer because it specifically mandates federal agencies to establish and maintain an agency-wide information security program. This legislation was enacted to enhance the security of government information and information systems, emphasizing the need for risk management and the implementation of security measures to protect federal data. FISMA outlines requirements for developing, documenting, and implementing information security programs, including regular assessments of risk, security controls, and compliance with guidance from the National Institute of Standards and Technology (NIST). This act also requires agencies to report on their security status and effectiveness of security measures, thereby promoting accountability and improving overall governmental cybersecurity posture. Other legislation options, while relevant to various aspects of information security and government operations, do not impose the same specific requirement for a comprehensive agency-wide information security program as FISMA does. The E-Government Act, GISRA, and the Clinger-Cohen Act focus on different areas, such as improving online services, promoting information security in broader terms, and strengthening IT management practices, respectively.

The Federal Information Security Management Act (FISMA) is the correct answer because it specifically mandates federal agencies to establish and maintain an agency-wide information security program. This legislation was enacted to enhance the security of government information and information systems, emphasizing the need for risk management and the implementation of security measures to protect federal data.

FISMA outlines requirements for developing, documenting, and implementing information security programs, including regular assessments of risk, security controls, and compliance with guidance from the National Institute of Standards and Technology (NIST). This act also requires agencies to report on their security status and effectiveness of security measures, thereby promoting accountability and improving overall governmental cybersecurity posture.

Other legislation options, while relevant to various aspects of information security and government operations, do not impose the same specific requirement for a comprehensive agency-wide information security program as FISMA does. The E-Government Act, GISRA, and the Clinger-Cohen Act focus on different areas, such as improving online services, promoting information security in broader terms, and strengthening IT management practices, respectively.