Which Federal mandate requires agencies to report incidents to US-CERT?

Which Federal mandate requires agencies to report incidents to US-CERT?

• A. FISMA
• B. NIST
• C. HIPAA
• D. FIPS

Answer: (A)

The correct answer is FISMA, which stands for the Federal Information Security Management Act. This legislation requires federal agencies to develop, document, and implement an information security program. One of the key components of FISMA is the mandate for federal agencies to report cybersecurity incidents to the United States Computer Emergency Readiness Team (US-CERT). This reporting is essential to help the federal government understand the scope and nature of cyber threats affecting agencies and to implement appropriate responses to those threats. FISMA emphasizes the importance of protecting government information and information infrastructure by ensuring that incidents are reported promptly, allowing for coordinated responses and fostering an environment of shared responsibility for cybersecurity. This aligns with the broader goals of improving information security across federal agencies, which is a critical aspect of national security. Other options, while related to security and handling of sensitive information, do not have the specific mandate for reporting incidents to US-CERT. NIST provides standards and guidelines for cybersecurity but does not require reporting. HIPAA governs the privacy and security of health information but is not focused on federal incident reporting. FIPS refers to federal information processing standards, which set forth requirements for federal computer systems but also do not include a reporting mandate to US-CERT.

The correct answer is FISMA, which stands for the Federal Information Security Management Act. This legislation requires federal agencies to develop, document, and implement an information security program. One of the key components of FISMA is the mandate for federal agencies to report cybersecurity incidents to the United States Computer Emergency Readiness Team (US-CERT). This reporting is essential to help the federal government understand the scope and nature of cyber threats affecting agencies and to implement appropriate responses to those threats.

FISMA emphasizes the importance of protecting government information and information infrastructure by ensuring that incidents are reported promptly, allowing for coordinated responses and fostering an environment of shared responsibility for cybersecurity. This aligns with the broader goals of improving information security across federal agencies, which is a critical aspect of national security.

Other options, while related to security and handling of sensitive information, do not have the specific mandate for reporting incidents to US-CERT. NIST provides standards and guidelines for cybersecurity but does not require reporting. HIPAA governs the privacy and security of health information but is not focused on federal incident reporting. FIPS refers to federal information processing standards, which set forth requirements for federal computer systems but also do not include a reporting mandate to US-CERT.