Federal Information Security Management Act (FISMA)
CyrusOne completed an independent security assessment of the information security controls outlined in the National Institute of Standards and Technology (NIST) Special Publication 800-53 revision 3 (SP 800-53.) NIST 800-53 outlines the controls that are required to comply with theFederal Information Security Management Act, or FISMA.
All government agencies, government contractors, and organizations that deal and exchange data with government systems must follow FISMA compliance guidelines. Organizations have to monitor, retain and maintain audit records of all security events as per FISMA (Federal Information Security Management Act).
The objective of FISMA compliance is to ensure that Federal departments and agencies observe measures to mitigate the security risks to critical data.
For federal agencies to use the services of a provider, the services must be based in a FISMA compliant data center that meets the stringent security requirements mandated by the Federal Information Security Management Act (FISMA). The National Institute of Standards and Technology (NIST) creates and maintains the specific security standards that agencies and their vendors are required to follow to remain compliant.
Agency compliance is ensured by the Office of Management and Budget (OMB), which each year reviews federal agencies’ IT programs to verify that they are FISMA compliant whether hosted on- or off-premise. The scope of the assessment included CyrusOne’s documented policies and procedures as well as controls implemented for its data centers. The controls that made up the assessment were awareness and training, incident response, maintenance, physical and environmental, personal security, and risk assessment.