The text of the IG FISMA Metric Alignment
Approval #
| Role | Name | Signature |
|---|---|---|
| Chief Information Security Officer (CISO) |
Revision History #
| Date | Version | Description | Reviewer |
|---|---|---|---|
| 2026-10-31 | 1.0 | Initial issuance | [Reviewer name] |
Review cycle: Every year, when the Inspector General issues the metrics for the reporting year.
1. Purpose and Scope #
The Inspector General evaluates the security program each year against the Inspector General (IG) Federal Information Security Modernization Act (FISMA) reporting metrics. This document is the one cross-reference between those metrics and the Organization’s policies and procedures. With it, the individual documents do not each need a copy of the metric text.
The first table lists each IG FISMA metric and the documents that hold the requirements behind it. The second table lists each document and the metrics it supports. The last part names any metric that no document covers yet.
A document covers a metric when it states the requirements the metric asks about. Coverage is not evidence. The procedure that performs the work names the evidence an evaluator asks for.
The Organization tracks 27 metrics. At least one document covers 27 of them, and 0 have no document yet.
2. Metrics to Documents #
2.1 Govern #
| Metric | Domain | What the metric asks | Control families | Documents |
|---|---|---|---|---|
| CG.01 | Cybersecurity Governance | To what extent does the organization develop and maintain cybersecurity profiles that are used to understand, tailor, assess, prioritize and communicate its cybersecurity objectives? | CA, PL, PM | POL-CA / PROC-CA, POL-PL / PROC-PL, POL-PM / PROC-PM |
| CG.03 | Cybersecurity Governance | To what extent do cybersecurity roles, responsibilities, and authorities foster accountability, performance assessment, and continuous improvement? | CA, PL, PM | POL-CA / PROC-CA, POL-PL / PROC-PL, POL-PM / PROC-PM |
| CG.04 | Cybersecurity Governance | Provide any additional information on the effectiveness (positive or negative) of the organization’s cybersecurity governance program that was not noted in the questions above. Taking into consideration the overall maturity level generated from the questions above and based on all testing performed, is the cybersecurity governance program effective? [CG.SUM] | CA, PL, PM | POL-CA / PROC-CA, POL-PL / PROC-PL, POL-PM / PROC-PM |
| C-SCRM.01 | Cybersecurity Supply Chain Risk Management | To what extent does the organization ensure that products, system components, systems, and services of external providers are consistent with the organization’s cybersecurity and supply chain requirements? | SA, SR | POL-SA / PROC-SA, POL-SR / PROC-SR |
| C-SCRM.06 | Cybersecurity Supply Chain Risk Management | Provide any additional information on the effectiveness (positive or negative) of the organization’s supply chain risk management program that was not noted in the questions above. Taking into consideration the overall maturity level generated from the questions above and based on all testing performed, is the supply chain risk management program effective? [C-SCRM.SUM] | SA, SR | POL-SA / PROC-SA, POL-SR / PROC-SR |
2.2 Identify #
| Metric | Domain | What the metric asks | Control families | Documents |
|---|---|---|---|---|
| RAM.01 | Risk and Asset Management | To what extent does the organization maintain a comprehensive and accurate inventory of its information systems (including cloud systems, public facing websites, and third-party systems), and system interconnections? | CM, PM, PT, RA | POL-CM / PROC-CM, POL-PM / PROC-PM, POL-PT / PROC-PT, POL-RA / PROC-RA |
| RAM.02 | Risk and Asset Management | To what extent does the organization use standard data elements/taxonomy to develop and maintain an up-to-date inventory of hardware assets (including Government Furnished Equipment (GFE), Internet of Things [Internet of Things (IoT)], and Bring Your Own Device [bring your own device (BYOD)] mobile devices) connected to the organization’s network with the detailed information necessary for tracking and reporting? | CM, PM, PT, RA | POL-CM / PROC-CM, POL-PM / PROC-PM, POL-PT / PROC-PT, POL-RA / PROC-RA |
| RAM.03 | Risk and Asset Management | To what extent does the organization use standard data elements/taxonomy to develop and maintain an up-to-date inventory of the software and associated licenses used within the organization with the detailed information necessary for tracking and reporting? | CM, PM, PT, RA | POL-CM / PROC-CM, POL-PM / PROC-PM, POL-PT / PROC-PT, POL-RA / PROC-RA |
| RAM.04 | Risk and Asset Management | To what extent does the organization develop and maintain inventories of data and corresponding metadata for designated data types, as appropriate throughout the data lifecycle? | CM, PM, PT, RA | POL-CM / PROC-CM, POL-PM / PROC-PM, POL-PT / PROC-PT, POL-RA / PROC-RA |
2.3 Protect #
| Metric | Domain | What the metric asks | Control families | Documents |
|---|---|---|---|---|
| CM.01 | Configuration Management | To what extent does the organization use configuration settings/common secure configurations for its information systems? | CM, SC | POL-CM / PROC-CM, POL-SC / PROC-SC |
| CM.02 | Configuration Management | To what extent does the organization use flaw remediation processes, including asset discovery, vulnerability scanning, analysis, and patch management, to manage software vulnerabilities on all network addressable Internet Protocol (IP)- assets? | CM, SC | POL-CM / PROC-CM, POL-SC / PROC-SC |
| CM.16 | Configuration Management | Provide any additional information (positive or negative) of the organization’s configuration management program that was not noted in the questions above. Taking into consideration the overall maturity level generated from the questions above and based on all testing performed, is the configuration management program effective? [CM.SUM] | CM, SC | POL-CM / PROC-CM, POL-SC / PROC-SC |
| IDAM.17 | Identity and Access Management | To what extent has the organization implemented phishing-resistant multi-factor authentication mechanisms (e.g., Personal Identity Verification (PIV), Fast Identity Online 2 (FIDO2), or web authentication) for non- privileged users to access the organization’s physical and logical assets [organization-defined entry/exit points], networks, and systems, including for remote access? [IDAM-01] | AC, IA | POL-AC / PROC-AC, POL-IA / PROC-IA |
| IDAM.18 | Identity and Access Management | To what extent has the organization implemented phishing-resistant multi-factor authentication mechanisms (e.g., PIV, FIDO2, or web authentication) for privileged users to access the organization’s physical and logical assets [organization-defined entry/exit points], networks, and systems, including for remote access? [IDAM-02] | AC, IA | POL-AC / PROC-AC, POL-IA / PROC-IA |
| IDAM.19 | Identity and Access Management | To what extent does the organization ensure that privileged accounts are provisioned, managed, and reviewed in accordance with the principles of least privilege and separation of duties? Specifically, this includes processes for periodic review and adjustment of privileged user accounts and permissions, inventorying and validating the scope and number of privileged accounts, and ensuring that privileged user account activities are logged and periodically reviewed? [IDAM-03] | AC, IA | POL-AC / PROC-AC, POL-IA / PROC-IA |
| IDAM.20 | Identity and Access Management | Provide any additional information (positive or negative) of the organization’s identity and access management (IDAM) program that was not noted in the questions above. Taking into consideration the overall maturity level generated from the questions above and based on all testing performed, is the IDAM program effective? [IDAM.SUM] | AC, IA | POL-AC / PROC-AC, POL-IA / PROC-IA |
| DPP.01 | Data Protection and Privacy | To what extent has the organization implemented the following security controls to protect the confidentiality, integrity, and availability of its personally identifiable information (PII) and other agency sensitive data, as appropriate, throughout the data lifecycle? • Encryption of data at rest • Encryption of data in transit • Limitation of transfer to removable media • Sanitization of digital media prior to disposal or reuse • Backups of data are created, protected, maintained, and tested •Access to personal email, external file sharing and storage sites, and personal communication applications are blocked, as appropriate. | AC, MP, PT, SC | POL-AC / PROC-AC, POL-MP / PROC-MP, POL-PT / PROC-PT, POL-SC / PROC-SC |
| DPP.02 | Data Protection and Privacy | To what extent has the organization implemented security controls (e.g., data loss prevention (DLP), intrusion detection and prevention system (IDPS), cloud access security broker (CASB), User and Entity Behavior Analytic tools, security information and event management (SIEM) and endpoint detection and response (EDR)) to prevent data exfiltration and enhance network defenses? | AC, MP, PT, SC | POL-AC / PROC-AC, POL-MP / PROC-MP, POL-PT / PROC-PT, POL-SC / PROC-SC |
| DPP.23 | Data Protection and Privacy | Provide any additional information (positive or negative) of the organization’s data protection and privacy program that was not noted in the questions above. Taking into consideration the overall maturity level generated from the questions above and based on all testing performed, is the data protection and privacy program effective? [DPP.SUM] | AC, MP, PT, SC | POL-AC / PROC-AC, POL-MP / PROC-MP, POL-PT / PROC-PT, POL-SC / PROC-SC |
| ST.01 | Security Training | To what extent does the organization use an assessment of the skills, knowledge, and abilities of its workforce to provide specialized security training within the functional areas of: govern, identify, protect, detect, respond, and recover?? | AT, PS | POL-AT / PROC-AT, POL-PS / PROC-PS |
| ST.25 | Security Training | Provide any additional information (positive or negative) of the organization’s security training program that was not noted in the questions above. Taking into consideration the overall maturity level generated from the questions above and based on all testing performed, is the security training program effective [ST.SUM]? | AT, PS | POL-AT / PROC-AT, POL-PS / PROC-PS |
2.4 Respond #
| Metric | Domain | What the metric asks | Control families | Documents |
|---|---|---|---|---|
| IR.01 | Incident Response | To what extent has the organization implemented processes related to incident detection and analysis? | AU, IR | POL-AU / PROC-AU, POL-IR / PROC-IR |
| IR.02 | Incident Response | To what extent has the organization implemented processes related to incident handling? | AU, IR | POL-AU / PROC-AU, POL-IR / PROC-IR |
| IR.32 | Incident Response | Provide any additional information (positive or negative) of the organization’s incident response program that was not noted in the questions above. Taking into consideration the overall maturity level generated from the questions above and based on all testing performed, is the incident response program effective? [IR.SUM] | AU, IR | POL-AU / PROC-AU, POL-IR / PROC-IR |
2.5 Recover #
| Metric | Domain | What the metric asks | Control families | Documents |
|---|---|---|---|---|
| CP.01 | Contingency Planning | To what extent does the organization ensure that the results of business impact analysiss (BIAs) are used to guide contingency planning efforts? | CP, MA | POL-CP / PROC-CP, POL-MA / PROC-MA |
| CP.02 | Contingency Planning | To what extent does the organization perform tests/exercises of its information system contingency planning processes? | CP, MA | POL-CP / PROC-CP, POL-MA / PROC-MA |
| CP.35 | Contingency Planning | Provide any additional information (positive or negative) of the organization’s contingency planning program that was not noted in the questions above. Taking into consideration the overall maturity level generated from the questions above and based on all testing performed, is the contingency planning program effective? [CP.SUM] | CP, MA | POL-CP / PROC-CP, POL-MA / PROC-MA |
3. Documents to Metrics #
| Document | Control family | IG FISMA metrics |
|---|---|---|
| POL-AC / PROC-AC | AC — Access Control | DPP.01, DPP.02, DPP.23, IDAM.17, IDAM.18, IDAM.19, IDAM.20 |
| POL-AT / PROC-AT | AT — Awareness and Training | ST.01, ST.25 |
| POL-AU / PROC-AU | AU — Audit and Accountability | IR.01, IR.02, IR.32 |
| POL-CA / PROC-CA | CA — Assessment, Authorization, and Monitoring | CG.01, CG.03, CG.04 |
| POL-CM / PROC-CM | CM — Configuration Management | CM.01, CM.02, CM.16, RAM.01, RAM.02, RAM.03, RAM.04 |
| POL-CP / PROC-CP | CP — Contingency Planning | CP.01, CP.02, CP.35 |
| POL-IA / PROC-IA | IA — Identification and Authentication | IDAM.17, IDAM.18, IDAM.19, IDAM.20 |
| POL-IR / PROC-IR | IR — Incident Response | IR.01, IR.02, IR.32 |
| POL-MA / PROC-MA | MA — Maintenance | CP.01, CP.02, CP.35 |
| POL-MP / PROC-MP | MP — Media Protection | DPP.01, DPP.02, DPP.23 |
| POL-PL / PROC-PL | PL — Planning | CG.01, CG.03, CG.04 |
| POL-PM / PROC-PM | PM — Program Management | CG.01, CG.03, CG.04, RAM.01, RAM.02, RAM.03, RAM.04 |
| POL-PS / PROC-PS | PS — Personnel Security | ST.01, ST.25 |
| POL-PT / PROC-PT | PT — Personally Identifiable Information Processing and Transparency | DPP.01, DPP.02, DPP.23, RAM.01, RAM.02, RAM.03, RAM.04 |
| POL-RA / PROC-RA | RA — Risk Assessment | RAM.01, RAM.02, RAM.03, RAM.04 |
| POL-SA / PROC-SA | SA — System and Services Acquisition | C-SCRM.01, C-SCRM.06 |
| POL-SC / PROC-SC | SC — System and Communications Protection | CM.01, CM.02, CM.16, DPP.01, DPP.02, DPP.23 |
| POL-SR / PROC-SR | SR — Supply Chain Risk Management | C-SCRM.01, C-SCRM.06 |
4. Metrics Not Yet Covered #
At least one document covers every metric.