Information Security Program Plan

Approval #

The Agency Head is accountable for the information security program under Federal Information Security Modernization Act (FISMA) 44 U.S.C. § 3554(a). That responsibility is delegated to the Chief Information Officer (CIO) and, through the CIO, to the Chief Information Security Officer (CISO) as the senior agency information security official (44 U.S.C. § 3554(a)(3)). The CISO approves this plan under that delegated authority.

Revision History #

Review cycle: Every year, under the Policy and Procedure Management Policy.

---

1. Introduction #

1.1 Purpose #

In this Information Security Program Plan (ISPP), the CISO sets out the framework for the information security program at the Organization. The ISPP covers how the Organization protects information and information systems under these authorities:

• The Federal Information Security Modernization Act (FISMA) of 2014.
• National Institute of Standards and Technology (NIST) Special Publication 800-53 Revision 5.
• Office of Management and Budget (OMB) Circular A-130.
• The federal laws, directives, and policies that apply.

The ISPP is the master document for the Organization’s common control program. Each system’s System Security and Privacy Plan (SSPP) cites the ISPP as the source of its inherited (common) controls.

1.2 Scope #

This ISPP applies to all information systems operated by or on behalf of the Organization, including:

• General support systems and infrastructure
• Major applications and business systems
• Cloud-based systems and services
• Contractor-operated systems processing the Organization data
• All users, personnel, and contractors with access to the Organization systems

The security controls implemented under this program are drawn from the NIST SP 800-53 Rev 5 moderate baseline, tailored to the organization’s risk profile and mission requirements.

1.3 Document Organization #

This ISPP is organized as follows:

---

2. Program Governance and Organization #

2.1 Security Program Structure #

The Organization maintains an information security program organized around the six functions of the NIST Cybersecurity Framework (CSF) 2.0: Govern, Identify, Protect, Detect, Respond, and Recover.

Executive Order 13800, Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure, requires federal agencies to use the NIST Cybersecurity Framework. OMB Circular A-130 adopts the framework to organize agency information security programs. The organization’s CSF 2.0 Profile maps each CSF category to the specific NIST SP 800-53 Rev 5 controls implemented under this program.

The program is managed by the Office of the Chief Information Security Officer (CISO) and operates under the authority of the Organization Director and the Authorizing Official (AO).

2.2 CSF 2.0 Framework Structure #

The organization’s security program is organized around the six CSF 2.0 functions and their 22 categories:

Each CSF 2.0 category maps to specific NIST SP 800-53 Rev 5 controls. The complete mapping is maintained in the organization’s CSF 2.0 Profile and is reflected in the policy-to-control traceability table (see §15).

2.3 Governance Bodies #

The following governance bodies oversee the information security program:

2.4 Compliance Framework #

The security program complies with the following federal requirements:

• FISMA 2014 — Federal Information Security Modernization Act
• OMB Circular A-130 — Managing Information as a Strategic Resource
• OMB Circular A-123 — Management’s Responsibility for Internal Control (revised March 10, 2026)
• NIST SP 800-53 Rev 5 — Security and Privacy Controls
• NIST SP 800-37 Rev 2 — Risk Management Framework
• NIST CSF 2.0 — Cybersecurity Framework (mandated by Executive Order (EO) 13800)
• Federal Information Processing Standards (FIPS) 199 — Standards for Security Categorization
• FIPS 200 — Minimum Security Requirements
• Inspector General (IG) FISMA Reporting Metrics (FY 2025) — Annual assessment criteria
• EO 13800 — Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure
• EO 14028 — Improving the Nation’s Cybersecurity
• EO 14144 — Strengthening and Promoting Innovation in the Nation’s Cybersecurity

---

3. Roles and Responsibilities #

The following roles are defined under NIST SP 800-18 Rev 2, OMB Circular A-130, and FISMA 2014. Each role carries specific security responsibilities as described in the 20 family-level policies.

Detailed role responsibilities for each control family are specified in the 20 family-level policy documents (see §6).

---

4. Risk Management Strategy #

4.1 Risk Management Framework #

The Organization manages security and privacy risk with the NIST Risk Management Framework (RMF) in NIST SP 800-37 Rev 2, within the three-level approach to risk in NIST SP 800-39:

• Organization level: the agency head sets the risk management strategy and risk tolerance; the CISO and the SAOP name the common controls.
• Mission and business process level: Mission/Business Owners define the processes systems support and the information those processes need.
• System level: System Owners, ISSOs, assessors, and Authorizing Officials carry each system through the RMF steps.

The RMF has seven steps. Prepare sets up the roles, strategy, common controls, and system context. Categorize decides how much harm a loss would cause (FIPS 199). Select chooses and tailors the controls. Implement puts them in place. Assess tests whether they work. Authorize has the Authorizing Official accept or reject the remaining risk in writing. Monitor keeps that decision current. The Assessment, Authorization, and Monitoring policy sets the rules for each step, and the matching procedure lists all 47 tasks, who does each one, and what each produces.

4.2 Risk Framing and Escalation #

The risk executive function records the Organization’s risk framing, as NIST SP 800-39 and control PM-28 describe. The Risk Management Strategy (PLAN-RMS-001) holds the framing: the assumptions, constraints, priorities and trade-offs, and the Risk Appetite and Tolerance Statement. The agency head approves it.

The CISO shares the framing with every Authorizing Official and System Owner. The risk executive function reviews it [PM-28 parameter 2 — to be defined].

An Authorizing Official may accept only risk within that tolerance. When a risk an Authorizing Official proposes to accept exceeds it, the CISO refers the risk through the CIO to the risk executive function. The Senior Accountable Official for Risk Management leads the risk executive function, as NIST SP 800-37 Rev 2 and control PM-29 describe. The risk executive function accepts the risk or directs the System Owner to reduce it. The ISSO records the decision in the governance, risk, and compliance (GRC) system.

4.3 Risk Assessment #

The Organization assesses risk under NIST SP 800-30 Rev 1 at three levels:

• Across the Organization: The CISO’s staff assess organization-wide risk annually.
• For each system: The System Owner and the ISSO assess the system’s risk before its first authorization and review the assessment at least annually.
• Between assessments: The ISSO follows risk through the information security continuous monitoring (ISCM) program (see §7).

4.4 Risk Response #

The Authorizing Official chooses one of four responses to each risk:

1. Accept: the residual risk is within the Authorizing Official’s acceptance threshold.
2. Mitigate: the System Owner adds or strengthens controls to reduce the risk.
3. Transfer: another party, such as a cloud service provider (CSP) or a contractor, takes on the risk.
4. Avoid: the Organization stops the activity that creates the risk.

The Risk Management Strategy sets which official may accept each level of risk and who must concur. The ISSO records every risk decision in the GRC system: an accepted risk as a risk acceptance, and a planned fix as a POA&M item. The ISSO follows each one through continuous monitoring, and keeps the system’s risk register entries in the fields of the Cybersecurity Risk Register Template (TMPL-RISKREG-001).

4.5 Risk Tiers #

The Organization categorizes systems into risk tiers based on FIPS 199 impact levels:

---

5. Control Selection and Tailoring Methodology #

5.1 Baseline Selection #

Security controls are selected from NIST SP 800-53 Rev 5 based on the FIPS 199 impact categorization of each system:

• Low-impact systems: Low baseline from SP 800-53B
• Moderate-impact systems: Moderate baseline from SP 800-53B
• High-impact systems: High baseline from SP 800-53B

The default baseline for the Organization systems is moderate.

5.2 Control Tailoring #

Baselines are tailored using the following methods (per SP 800-53 §3.3):

1. Overlay application: Organization-specific overlays (privacy, supply chain) are applied to supplement the baseline
2. Supplementation: Additional controls or enhancements are added based on risk assessment findings
3. Scoping: Controls are scoped based on:
   • Common controls (organization-wide, inherited by systems)
   • Hybrid controls (partially inherited, partially system-specific)
   • System-specific controls (implemented at the system level)
4. Parameter value assignment: Organization-defined parameters (ODPs) are assigned values based on organizational policy and risk tolerance

5.3 Common Control Allocation #

The Organization serves as the Common Control Provider (CCP) for the following control types:

The complete control allocation matrix is maintained as a separate deliverable (MAT-Control-Allocation.xlsx) and is referenced by each system SSPP.

Assessment, authorization, and monitoring of common controls. An independent Security Control Assessor assesses the common controls, and the common part of each hybrid control, every year and on the continuous monitoring schedule. The Authorizing Official for common controls authorizes them in writing. The Common Control Provider keeps a POA&M item in the GRC system for each common control that does not work as intended. The Common Control Provider also sends a status report to the Authorizing Official of each inheriting system. The report goes before that system’s authorization and [CA-07 parameter 5 — to be defined] after it.

5.4 ODP Value Management #

Organization-defined parameters (ODPs) are managed centrally to ensure consistency across all systems. The ODP register (MAT-ODP-Register.xlsx) documents:

• All ODP values with provenance (org-defined vs Federal Risk and Authorization Management Program (FedRAMP) default)
• The control and parameter each value applies to
• The policy or procedure that establishes the value

Currently, 264 ODP values are defined: - 0 organization-defined values - 264 FedRAMP best-practice defaults

Where a control has no defined ODP value, the generated documents mark it with an explicit “Assignment: organization-defined … to be defined” note. The System Owner must assign a value before the system’s authorization.

---

6. Security Policy Framework #

The Information System Security Policy (POL-ISSP-001) is the Organization’s top-level security policy. It assigns each role its duties across every control family. Below it, 20 family policies each cover one NIST SP 800-53 Rev 5 control family and hold the full requirements for that family.

Each policy document includes: - Purpose and scope - Authority and governance references - Policy statements (one per control, written as mandates) - Roles and responsibilities - Compliance requirements and maturity targets - Control-to-metric traceability

The corresponding procedures provide step-by-step implementation guidance for each control within the family.

---

7. Continuous Monitoring and FISMA Reporting #

7.1 ISCM Strategy #

The Organization maintains an Information Security Continuous Monitoring (ISCM) program under NIST SP 800-137. The ISCM strategy encompasses:

• Asset management: Automated inventory of all hardware, software, and data assets
• Configuration management: Continuous assessment of security configuration baselines
• Vulnerability management: Ongoing vulnerability scanning and remediation tracking
• Security event monitoring: Centralized log collection and security information and event management (SIEM) analysis
• Control assessment: Ongoing control effectiveness assessment

7.2 Monitoring Cadence #

7.3 Reporting #

Security status is reported through:

• Monthly: Security posture dashboard to the Cybersecurity Executive Council
• Quarterly: FISMA metrics report to OMB via CyberScope
• Annually: IG FISMA assessment and reporting

7.4 FISMA Reporting #

Each year, the Organization reports on its security and privacy programs as 44 U.S.C. 3554(c) requires, on the dates in the current OMB FISMA guidance:

1. The CISO runs the annual data call to System Owners and ISSOs and prepares the CIO section of the report.
2. The SAOP prepares the privacy section of the report.
3. The CIO reviews and approves both sections.
4. The agency head signs a letter to OMB that assesses whether the Organization’s security policies, procedures, and practices are adequate and effective.
5. The CIO sends the report to OMB and the Cybersecurity and Infrastructure Security Agency (CISA), to the congressional committees that 44 U.S.C. 3554(c) names, and to the Government Accountability Office (GAO).

Each quarter, the CISO submits the CIO FISMA metrics to OMB through CyberScope, on the schedule in the current OMB FISMA guidance. The CISO also supports the Inspector General’s annual independent evaluation under 44 U.S.C. 3555.

---

8. Security Training and Workforce #

8.1 Training Program #

The Organization maintains a security awareness and training program under NIST SP 800-50 and the NIST SP 800-53 AT control family:

The role-based rows follow the groups in 5 CFR 930.301. The CISO keeps a role catalog that maps each of those groups to the Organization’s roles. Supervisors and Contracting Officer’s Representatives tell the CISO who holds each role. The Security Training Coordinator records completion in the learning management system (LMS).

8.2 Workforce Development #

The security workforce is developed under the National Initiative for Cybersecurity Education (NICE) Cybersecurity Workforce Framework (SP 800-181):

• Role definitions aligned to NICE work roles
• Competency assessments for security positions
• Professional certification support (CISSP, CISM, GIAC, etc.)
• Career path development for security professionals

---

9. Incident Response Program #

9.1 IR Program Structure #

The Organization maintains an incident response program under NIST SP 800-61 Rev 3 and the NIST SP 800-53 IR control family. NIST SP 800-61 Rev 3 organizes incident response around the six CSF 2.0 functions:

• Govern, Identify, and Protect (preparation): The CISO sets incident response policy, roles, and plans. System Owners reduce how often incidents happen and how much harm they cause.
• Detect: The Security Operations Center (SOC) finds and analyzes possible incidents.
• Respond: The Incident Response Team contains each incident, removes its cause, and reports it.
• Recover: System Owners restore affected systems and confirm that they work.
• Improvement: After each significant incident, the Incident Response Team reviews the lessons learned. The CISO then updates the policies and controls they affect.

9.2 Reporting Requirements #

The Incident Response Team reports incidents under these authorities:

• The CISA Federal Incident Notification Guidelines, for reporting incidents to CISA within 1 hour through the CISA Incident Reporting Form.
• The current OMB FISMA guidance, for deciding whether an incident is a major incident and for reporting it to Congress and the Inspector General (44 U.S.C. 3554(b)(7)).
• OMB M-17-12, for breaches of personally identifiable information.
• The escalation steps in the Organization’s Incident Response Plan.

---

10. Contingency Planning Program #

10.1 CP Program Structure #

The Organization maintains a contingency planning program under NIST SP 800-34 Rev 1 and the NIST SP 800-53 CP control family:

• Business Impact Analysis (BIA): The System Owner completes a BIA for every system, at every impact level.

• Contingency plans: The System Owner builds each system’s contingency plan from its BIA results.

• Testing: The System Owner tests each plan at least annually, with the test type the Contingency Planning Policy sets for the system’s impact level:

  • Functional exercises.

• Alternate processing: System Owners arrange alternate sites that meet each system’s recovery time objective (RTO).

---

11. Privacy Program #

11.1 Privacy Program Structure #

The agency head designates a Senior Agency Official for Privacy (SAOP) under Executive Order 13719 and OMB M-16-24. The SAOP leads the privacy program under:

• The Privacy Act of 1974.
• The E-Government Act of 2002 (Section 208).
• OMB Circular A-130 and OMB Circular A-108.
• OMB M-17-12, for breaches of PII.
• The NIST SP 800-53 PT controls and program management controls PM-18 through PM-27.

11.2 Privacy Program Plan and Continuous Monitoring #

The SAOP issues and approves the privacy program plan (PM-18). The plan describes the program’s structure, resources, and roles. It lists the privacy controls the Organization designates as common, hybrid, or system-specific. The SAOP also keeps a privacy continuous monitoring strategy, as OMB Circular A-130 requires. The strategy sets how often the Privacy Officer assesses each privacy control.

For each system that processes PII, the SAOP approves the privacy plan and the privacy control assessment before the Authorizing Official decides. The SAOP prepares the privacy section of the annual FISMA report.

11.3 Privacy Threshold Analysis, PIA, and SORN #

1. The System Owner completes a privacy threshold analysis (PTA) before the Organization builds or buys a system. The System Owner updates it when the system adds a new type of PII.
2. The SAOP uses the PTA to decide whether the system needs a Privacy Impact Assessment (PIA), a System of Records Notice (SORN), or a Privacy Act statement.
3. The System Owner prepares the PIA with the Privacy Officer under OMB M-03-22. The SAOP approves it before the system is authorized, and the Privacy Officer publishes it.
4. The Privacy Officer prepares each new or changed SORN under OMB Circular A-108. The SAOP approves it before the Organization publishes it in the Federal Register.
5. The System Owner puts a Privacy Act statement on each form that collects PII for a system of records (5 U.S.C. 552a(e)(3)).

The PII Processing and Transparency Policy and its procedure hold the detailed steps.

11.4 Privacy Training and Other Activities #

• Privacy training: The SAOP owns the privacy content of security awareness training. The SAOP also provides role-based privacy training to staff and contractors who handle PII as part of their duties (AT-03(5)). The Security Training Coordinator records completion in the LMS.
• PII inventory: The Privacy Officer keeps the inventory of PII and reviews it with System Owners.
• Data minimization: System Owners collect only the PII their stated purpose needs.
• Breach response: The SAOP leads breach response under the Breach Response Plan and OMB M-17-12.

---

12. Supply Chain Risk Management #

12.1 C-SCRM Program #

The Organization maintains a Cybersecurity Supply Chain Risk Management (C-SCRM) program under:

• The Federal Acquisition Supply Chain Security Act (41 U.S.C. 1321–1328 and 4713).
• Federal Acquisition Regulation (FAR) Part 40 and the FAR 52.204 supply chain clauses.
• NIST SP 800-161 Rev 1.
• OMB M-26-05, which rescinded M-22-18 and M-23-16.
• EO 14028.
• The NIST SP 800-53 SA and SR control families.

12.2 C-SCRM Activities #

• Supplier assessments: Conducted for all critical suppliers
• Component authenticity: Verified through approved supplier channels
• Software bill of materials (SBOM): Required for all acquired software
• Vulnerability disclosure: Coordinated through CISA Binding Operational Directive (BOD) 20-01 vulnerability disclosure policy (VDP)

---

13. Program Maturity Strategy and Performance Management #

13.1 IG FISMA Maturity Model Commitment #

The program is managed against the Inspector General FISMA maturity model (Level 1 Ad Hoc through Level 5 Optimized). The organization’s standing target is Level 4: Managed and Measurable, with a documented roadmap toward Level 5: Optimized. This means, concretely:

• Defined (Level 2): Every control family has an issued policy and procedure (the POL-/PROC- document set generated under this program), reviewed on the cycles stated in each document.
• Consistently Implemented (Level 3): Controls operate across all systems per the SSPP inheritance model; deviations are documented exceptions, not silent gaps.
• Managed and Measurable (Level 4): Each family policy defines quantitative performance measures with targets, collection frequencies, and data sources. The CISO trends these measures and reports them to the CIO and Authorizing Officials; off-target trends open POA&M items.
• Optimized (Level 5): Each family policy carries continuous improvement commitments — target tightening when measures hold, lessons learned integrated within 90 days, and automation objectives that reduce manual control operation.

13.2 Performance Reporting Cadence #

13.3 Annual Program Self-Assessment #

Before each annual Office of Inspector General (OIG) FISMA evaluation, the CISO assesses the program against the current-year IG FISMA metrics and documents the result. The CISO scores each metric domain and opens corrective actions for any domain below target. Self-assessment results, evidence inventories, and corrective action status are retained as audit-ready artifacts.

---

14. Governance References #

The following authoritative sources govern the Organization information security program:

• Taxpayer identifying number from persons doing business with an agency (31 U.S.C. § 7701(c)).
• 32 CFR Part 2002: Controlled Unclassified Information, September 14, 2016.
• Information and Communication Technology Standards and Guidelines (Revised 508 Standards, 36 CFR Part 1194): Information and Communication Technology Standards and Guidelines, January 18, 2017.
• Capital planning and investment control process of each executive agency (40 U.S.C. § 11312).
• Agency Chief Information Officer (40 U.S.C. § 11315).
• Resources, planning, and portfolio management (FITARA Chief Information Officer authorities) (40 U.S.C. § 11319).
• 41 CFR Part 102-35: Disposition of Personal Property, December 16, 2025.
• 41 CFR Part 102-36: Disposition of Excess Personal Property, December 16, 2025.
• Requirements for executive agencies (Federal Acquisition Supply Chain Security Act) (41 U.S.C. § 1326), December 21, 2018.
• Social Security Act section 205(c)(2)(C): Social Security number confidentiality, and no display on checks or access by prisoners (42 U.S.C. § 405(c)(2)(C)(viii), (xi), (xii); 42 U.S.C. § 408(a)(8)), current text.
• Disclosure requirement for official business conducted using non-official electronic messaging accounts (44 U.S.C. § 2911).
• Designation of National Security Positions (5 CFR Part 1400): Designation of National Security Positions, June 5, 2015.
• Suitability and Fitness (5 CFR Part 731): Suitability and Fitness, current text.
• CISA BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks, October 3, 2022.
• CISA BOD 23-02: Mitigating the Risk from Internet-Exposed Management Interfaces, June 13, 2023.
• CISA BOD 25-01: Implementing Secure Practices for Cloud Services, December 17, 2024.
• CISA BOD 26-04: Prioritizing Security Updates Based on Risk, June 10, 2026.
• Implementation Guidance for Prioritizing Security Updates Based on Risk, June 10, 2026.
• CISA High Value Asset (HVA) Control Overlay v1.0, November 1, 2017.
• CISA Incident Reporting System: Incident Reporting Form (CISA Services Portal): Incident Reporting Form (CISA Services Portal), August 29, 2024.
• Federal Incident Notification Guidelines, April 1, 2017.
• CISA Known Exploited Vulnerabilities Catalog, updated continuously.
• CISA Logging Reference Architecture (companion to OMB M-26-14), August 20, 2026.
• 2026 Minimum Elements for a Software Bill of Materials (SBOM) — CISA/NSA/FBI joint guidance: CISA/NSA/FBI joint guidance, July 29, 2026.
• Secure Cloud Business Applications (SCuBA) Project: Secure Configuration Baselines.
• CISA Zero Trust Maturity Model, April 11, 2023.
• FIPS 140-3 Transition Effort, updated continuously.
• CUI Registry.
• OMB Circular A-123: Management’s Responsibility for Internal Control, March 10, 2026.
• OMB Circular A-130: Managing Information as a Strategic Resource, July 28, 2016.
• Executive Order 13719: Establishment of the Federal Privacy Council, February 9, 2016.
• Executive Order 13764: Amending the Civil Service Rules, Executive Order 13488, and Executive Order 13467 To Modernize the Executive Branch-Wide Governance Structure and Processes for Security Clearances, Suitability and Fitness for Employment, and Credentialing, and Related Matters, January 17, 2017.
• Executive Order 13800: Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure, May 11, 2017.
• Executive Order 14028: Improving the Nation’s Cybersecurity, May 12, 2021.
• Executive Order 14144: Strengthening and Promoting Innovation in the Nation’s Cybersecurity, January 16, 2025.
• Executive Order 14306: Sustaining Select Efforts to Strengthen the Nation’s Cybersecurity and Amending EO 13694 and EO 14144, June 6, 2025.
• Executive Order 14412: Securing the Nation Against Advanced Cryptographic Attacks, June 22, 2026.
• Executive Order 14432: Streamlining Access to Government Services Through America.gov, September 29, 2026.
• Executive Order 14434: Inaugurating the Era of Super Intelligence, September 29, 2026.
• FAR 52.204-3: Taxpayer Identification, October 1998.
• FAR 52.204-30: Federal Acquisition Supply Chain Security Act Orders — Prohibition (with FAR 52.204-29 representation and disclosures), December 4, 2023.
• FAR 52.204-9: Personal Identity Verification of Contractor Personnel, January 2011.
• FAR 52.224-1: Privacy Act Notification, April 1984.
• FAR 52.224-2: Privacy Act, April 1984.
• FAR 52.224-3: Privacy Training, January 2017.
• FAR 52.239-1: Privacy or Security Safeguards, August 1996.
• Exclusion and Removal of DeepSeek Products and Services from Federal Civilian Executive Branch Information Technology Systems, July 24, 2026.
• Exclusion and Removal of Acronis Products and Services from Federal Civilian Executive Branch Information Technology Systems, July 31, 2026.
• FIPS 199: Standards for Security Categorization, February 2004.
• FIPS 200: Minimum Security Requirements for Federal Information and Information Systems, March 2006.
• Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3551 et seq.), December 18, 2014.
• FedRAMP Authorization Act (44 U.S.C. §§ 3607-3616 (FY2023 NDAA, Pub. L. 117-263, § 5921)), December 23, 2022.
• FedRAMP Consolidated Rules for 2026 (including 20x Key Security Indicators), June 24, 2026.
• HSPD-12: Policy for a Common Identification Standard for Federal Employees and Contractors, August 27, 2004.
• Internet of Things Cybersecurity Improvement Act of 2020 (Pub. L. 116-207; 15 U.S.C. §§ 278g-3a to 278g-3e), December 4, 2020.
• OMB M-02-01: Guidance for Preparing and Submitting Security Plans of Action and Milestones, October 17, 2001.
• OMB M-16-12: Category Management Policy 16-1: Improving the Acquisition and Management of Common Information Technology: Software Licensing, June 2, 2016.
• OMB M-21-07: Completing the Transition to Internet Protocol Version 6 (IPv6), November 19, 2020.
• OMB M-22-09: Moving the U.S. Government Toward Zero Trust Cybersecurity Principles, January 26, 2022.
• OMB M-23-22: Delivering a Digital-First Public Experience, September 22, 2023.
• OMB M-24-15: Modernizing the Federal Risk and Authorization Management Program (FedRAMP), July 25, 2024.
• OMB M-25-04: FY 2025 Guidance on Federal Information Security and Privacy Management Requirements, January 15, 2025.
• OMB M-26-05: Adopting a Risk-based Approach to Software and Hardware Security, January 23, 2026.
• OMB M-26-14: Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats, May 22, 2026.
• OMB M-26-15: Execution of the Migration to Post-Quantum Cryptography, June 24, 2026.
• OMB M-26-18: Scaling Use of Login.gov to Deliver a Universal Sign-on for Public Services, August 31, 2026.
• Making Electronic Government Accountable By Yielding Tangible Efficiencies Act of 2016 (MEGABYTE Act) (Pub. L. 114-210), July 29, 2016.
• NARA General Records Schedule 3.1: General Technology Management Records.
• NARA General Records Schedule 3.2: Information Systems Security Records.
• NIST Cybersecurity Framework 2.0, February 26, 2024.
• Privacy Act of 1974 (5 U.S.C. § 552a), December 31, 1974.
• NIST SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations, November 1, 2024.
• NIST SP 800-18 Rev. 2: Developing System Plans (system security plans, system privacy plans, C-SCRM plans), June 30, 2026.
• NIST SP 800-207: Zero Trust Architecture, August 2020.
• NIST SP 800-30 Rev. 1: Guide for Conducting Risk Assessments, September 2012.
• NIST SP 800-37 Rev. 2: Risk Management Framework for Information Systems and Organizations, December 2018.
• NIST SP 800-39: Managing Information Security Risk: Organization, Mission, and Information System View, March 2011.
• NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations, September 2020.
• NIST SP 800-53A Rev. 5: Assessing Security and Privacy Controls, January 2022.
• NIST SP 800-53B: Control Baselines for Information Systems and Organizations, September 2020.
• NIST SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management, April 2025.
• NIST SP 800-63-4: Digital Identity Guidelines, July 31, 2025.
• Social Security Number Fraud Prevention Act of 2017 (Pub. L. 115-59), September 15, 2017.
• Section 508 of the Rehabilitation Act of 1973 (Electronic and Information Technology) (29 U.S.C. § 794d), August 7, 1998.

---

15. Policy-to-Control Traceability #

The following table maps each policy document to the control families it covers and the IG FISMA metrics it satisfies:

---

16. References #

These are the sources this document cites, with a link to each official text.

• 5 CFR § 930.301: Information Systems Security Awareness Training Program — role-based training for personnel with significant security responsibilities, June 17, 2004.
• 32 CFR Part 2002: Controlled Unclassified Information, September 14, 2016.
• 41 CFR Part 102-35: Disposition of Personal Property, December 16, 2025.
• 41 CFR Part 102-36: Disposition of Excess Personal Property, December 16, 2025.
• 2026 Minimum Elements for a Software Bill of Materials (SBOM) — CISA/NSA/FBI joint guidance: CISA/NSA/FBI joint guidance, July 29, 2026.
• Agency Chief Information Officer (40 U.S.C. § 11315).
• Capital planning and investment control process of each executive agency (40 U.S.C. § 11312).
• CISA BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks, October 3, 2022.
• CISA BOD 23-02: Mitigating the Risk from Internet-Exposed Management Interfaces, June 13, 2023.
• CISA BOD 25-01: Implementing Secure Practices for Cloud Services, December 17, 2024.
• CISA BOD 26-04: Prioritizing Security Updates Based on Risk, June 10, 2026.
• CISA Incident Reporting System: Incident Reporting Form (CISA Services Portal): Incident Reporting Form (CISA Services Portal), August 29, 2024.
• CISA Known Exploited Vulnerabilities Catalog, updated continuously.
• CISA Logging Reference Architecture (companion to OMB M-26-14), August 20, 2026.
• CISA Zero Trust Maturity Model, April 11, 2023.
• CUI Registry.
• Designation of National Security Positions (5 CFR Part 1400): Designation of National Security Positions, June 5, 2015.
• Disclosure requirement for official business conducted using non-official electronic messaging accounts (44 U.S.C. § 2911).
• E-Government Act of 2002 (Pub. L. 107-347), December 17, 2002.
• Executive Order 13467: Reforming Processes Related to Suitability for Government Employment, Fitness for Contractor Employees, and Eligibility for Access to Classified National Security Information, June 30, 2008.
• Executive Order 13488: Granting Reciprocity on Excepted Service and Federal Contractor Employee Fitness and Reinvestigating Individuals in Positions of Public Trust, January 16, 2009.
• Executive Order 13694: Blocking the Property of Certain Persons Engaging in Significant Malicious Cyber-Enabled Activities, April 1, 2015.
• Executive Order 13719: Establishment of the Federal Privacy Council, February 9, 2016.
• Executive Order 13764: Amending the Civil Service Rules, Executive Order 13488, and Executive Order 13467 To Modernize the Executive Branch-Wide Governance Structure and Processes for Security Clearances, Suitability and Fitness for Employment, and Credentialing, and Related Matters, January 17, 2017.
• Executive Order 13800: Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure, May 11, 2017.
• Executive Order 14028: Improving the Nation’s Cybersecurity, May 12, 2021.
• Executive Order 14144: Strengthening and Promoting Innovation in the Nation’s Cybersecurity, January 16, 2025.
• Executive Order 14306: Sustaining Select Efforts to Strengthen the Nation’s Cybersecurity and Amending EO 13694 and EO 14144, June 6, 2025.
• Executive Order 14412: Securing the Nation Against Advanced Cryptographic Attacks, June 22, 2026.
• Executive Order 14432: Streamlining Access to Government Services Through America.gov, September 29, 2026.
• Executive Order 14434: Inaugurating the Era of Super Intelligence, September 29, 2026.
• FAR 52.204-3: Taxpayer Identification, October 1998.
• FAR 52.204-9: Personal Identity Verification of Contractor Personnel, January 2011.
• FAR 52.204-30: Federal Acquisition Supply Chain Security Act Orders — Prohibition (with FAR 52.204-29 representation and disclosures), December 4, 2023.
• FAR 52.224-1: Privacy Act Notification, April 1984.
• FAR 52.224-2: Privacy Act, April 1984.
• FAR 52.224-3: Privacy Training, January 2017.
• FAR 52.239-1: Privacy or Security Safeguards, August 1996.
• Federal Acquisition Regulation (FAR), current text.
• Federal Incident Notification Guidelines, April 1, 2017.
• Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3551 et seq.), December 18, 2014.
• FedRAMP Authorization Act (44 U.S.C. §§ 3607-3616 (FY2023 NDAA, Pub. L. 117-263, § 5921)), December 23, 2022.
• FedRAMP Consolidated Rules for 2026 (including 20x Key Security Indicators), June 24, 2026.
• FIPS 140-3 Transition Effort, updated continuously.
• FIPS 199: Standards for Security Categorization, February 2004.
• FIPS 200: Minimum Security Requirements for Federal Information and Information Systems, March 2006.
• HSPD-12: Policy for a Common Identification Standard for Federal Employees and Contractors, August 27, 2004.
• Implementation Guidance for Prioritizing Security Updates Based on Risk, June 10, 2026.
• Information and Communication Technology Standards and Guidelines (Revised 508 Standards, 36 CFR Part 1194): Information and Communication Technology Standards and Guidelines, January 18, 2017.
• Internet of Things Cybersecurity Improvement Act of 2020 (Pub. L. 116-207; 15 U.S.C. §§ 278g-3a to 278g-3e), December 4, 2020.
• Making Electronic Government Accountable By Yielding Tangible Efficiencies Act of 2016 (MEGABYTE Act) (Pub. L. 114-210), July 29, 2016.
• NARA General Records Schedule 3.1: General Technology Management Records.
• NARA General Records Schedule 3.2: Information Systems Security Records.
• NIST Cybersecurity Framework 2.0, February 26, 2024.
• NIST SP 800-18 Rev. 2: Developing System Plans (system security plans, system privacy plans, C-SCRM plans), June 30, 2026.
• NIST SP 800-30 Rev. 1: Guide for Conducting Risk Assessments, September 2012.
• NIST SP 800-34 Rev. 1: Contingency Planning Guide for Federal Information Systems, May 2010.
• NIST SP 800-37 Rev. 2: Risk Management Framework for Information Systems and Organizations, December 2018.
• NIST SP 800-39: Managing Information Security Risk: Organization, Mission, and Information System View, March 2011.
• NIST SP 800-50 Rev. 1: Building a Cybersecurity and Privacy Learning Program, September 2024.
• NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations, September 2020.
• NIST SP 800-53A Rev. 5: Assessing Security and Privacy Controls, January 2022.
• NIST SP 800-53B: Control Baselines for Information Systems and Organizations, September 2020.
• NIST SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management, April 2025.
• NIST SP 800-63-4: Digital Identity Guidelines, July 31, 2025.
• NIST SP 800-137: Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations, September 30, 2011.
• NIST SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations, November 1, 2024.
• NIST SP 800-181 Rev. 1: Workforce Framework for Cybersecurity (NICE Framework), November 2020.
• NIST SP 800-207: Zero Trust Architecture, August 2020.
• OMB Circular A-108: Federal Agency Responsibilities for Review, Reporting, and Publication under the Privacy Act, December 23, 2016.
• OMB Circular A-123: Management’s Responsibility for Internal Control, March 10, 2026.
• OMB Circular A-130: Managing Information as a Strategic Resource, July 28, 2016.
• OMB M-02-01: Guidance for Preparing and Submitting Security Plans of Action and Milestones, October 17, 2001.
• OMB M-03-22: OMB Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002, September 26, 2003.
• OMB M-16-12: Category Management Policy 16-1: Improving the Acquisition and Management of Common Information Technology: Software Licensing, June 2, 2016.
• OMB M-16-24: Role and Designation of Senior Agency Officials for Privacy, September 15, 2016.
• OMB M-17-12: Preparing for and Responding to a Breach of Personally Identifiable Information, May 22, 2017.
• OMB M-21-07: Completing the Transition to Internet Protocol Version 6 (IPv6), November 19, 2020.
• OMB M-22-09: Moving the U.S. Government Toward Zero Trust Cybersecurity Principles, January 26, 2022.
• Superseded source, kept for its history: OMB M-22-18: Enhancing the Security of the Software Supply Chain through Secure Software Development Practices, September 14, 2022. Replaced by OMB M-26-05.
• Superseded source, kept for its history: OMB M-23-16: Update to M-22-18: Enhancing the Security of the Software Supply Chain through Secure Software Development Practices, June 27, 2023. Replaced by OMB M-26-05.
• OMB M-23-22: Delivering a Digital-First Public Experience, September 22, 2023.
• OMB M-24-15: Modernizing the Federal Risk and Authorization Management Program (FedRAMP), July 25, 2024.
• OMB M-25-04: FY 2025 Guidance on Federal Information Security and Privacy Management Requirements, January 15, 2025.
• OMB M-26-05: Adopting a Risk-based Approach to Software and Hardware Security, January 23, 2026.
• OMB M-26-14: Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats, May 22, 2026.
• OMB M-26-15: Execution of the Migration to Post-Quantum Cryptography, June 24, 2026.
• OMB M-26-18: Scaling Use of Login.gov to Deliver a Universal Sign-on for Public Services, August 31, 2026.
• Privacy Act of 1974 (5 U.S.C. § 552a), December 31, 1974.
• Requirements for executive agencies (Federal Acquisition Supply Chain Security Act) (41 U.S.C. § 1326), December 21, 2018.
• Resources, planning, and portfolio management (FITARA Chief Information Officer authorities) (40 U.S.C. § 11319).
• Section 508 of the Rehabilitation Act of 1973 (Electronic and Information Technology) (29 U.S.C. § 794d), August 7, 1998.
• Social Security Act section 205(c)(2)(C): Social Security number confidentiality, and no display on checks or access by prisoners (42 U.S.C. § 405(c)(2)(C)(viii), (xi), (xii); 42 U.S.C. § 408(a)(8)), current text.
• Social Security Number Fraud Prevention Act of 2017 (Pub. L. 115-59), September 15, 2017.
• Strengthening and Enhancing Cyber-capabilities by Utilizing Risk Exposure Technology Act (SECURE Technology Act) — Federal Acquisition Security Council (Pub. L. 115-390, Title II; 41 U.S.C. §§ 1321–1328; 41 U.S.C. § 4713), December 21, 2018.
• Suitability and Fitness (5 CFR Part 731): Suitability and Fitness, current text.
• Taxpayer identifying number from persons doing business with an agency (31 U.S.C. § 7701(c)).