Which legislation requires an annual evaluation of an agency's information security program by its Inspector General or an external auditor?

Which legislation requires an annual evaluation of an agency's information security program by its Inspector General or an external auditor?

• A. E-Government Act of 2002, Title I
• B. Federal Information Security Management Act (FISMA)
• C. Government Information Security Reform Act (GISRA)
• D. Clinger-Cohen Act

Answer: (B)

The Federal Information Security Management Act (FISMA) is the legislation that mandates an annual evaluation of an agency's information security program. FISMA requires federal agencies to develop, document, and implement an information security program that is evaluated continuously. An essential component of FISMA is that the evaluation must be performed by the agency's Inspector General or an external auditor, ensuring that there is an objective assessment of the compliance and effectiveness of the information security policies and procedures in place. This focus on annual evaluations underscores the importance of maintaining robust information security practices in the federal sector, given the increasing threats to information technology environments. The requirement for independent assessments helps ensure accountability and encourages continuous improvement of security measures across governmental agencies.

The Federal Information Security Management Act (FISMA) is the legislation that mandates an annual evaluation of an agency's information security program. FISMA requires federal agencies to develop, document, and implement an information security program that is evaluated continuously. An essential component of FISMA is that the evaluation must be performed by the agency's Inspector General or an external auditor, ensuring that there is an objective assessment of the compliance and effectiveness of the information security policies and procedures in place.

This focus on annual evaluations underscores the importance of maintaining robust information security practices in the federal sector, given the increasing threats to information technology environments. The requirement for independent assessments helps ensure accountability and encourages continuous improvement of security measures across governmental agencies.