Which act provides a comprehensive framework for ensuring the effectiveness of information security controls over information resources that support federal operations and assets?

Which act provides a comprehensive framework for ensuring the effectiveness of information security controls over information resources that support federal operations and assets?

• A. The Federal Information Security Management Act (FISMA)
• B. Sarbanes-Oxley Act (SOX)
• C. Data Protection Act 2018 (DPA)
• D. Digital Millennium Copyright Act (DMCA)

Answer: (A)

FISMA establishes a comprehensive framework for ensuring the effectiveness of information security controls over information resources that support federal operations and assets. It requires federal agencies to develop, document, and implement an information security program, classify information systems by impact, and select and implement security controls from a standardized catalog (aligned with NIST SP 800-53). Agencies must perform risk assessments, obtain formal authorization to operate, and maintain continuous monitoring to keep controls effective throughout a system’s life cycle. Oversight comes from bodies like OMB and GAO, with annual reporting to Congress, ensuring ongoing governance, risk management, and assurance across all federal information resources. In contrast, the other acts focus on private-sector financial reporting (Sarbanes-Oxley), data privacy rules in other jurisdictions (Data Protection Act 2018), or copyright and anti-circumvention (DMCA), not a federal information security framework.

FISMA establishes a comprehensive framework for ensuring the effectiveness of information security controls over information resources that support federal operations and assets. It requires federal agencies to develop, document, and implement an information security program, classify information systems by impact, and select and implement security controls from a standardized catalog (aligned with NIST SP 800-53). Agencies must perform risk assessments, obtain formal authorization to operate, and maintain continuous monitoring to keep controls effective throughout a system’s life cycle. Oversight comes from bodies like OMB and GAO, with annual reporting to Congress, ensuring ongoing governance, risk management, and assurance across all federal information resources. In contrast, the other acts focus on private-sector financial reporting (Sarbanes-Oxley), data privacy rules in other jurisdictions (Data Protection Act 2018), or copyright and anti-circumvention (DMCA), not a federal information security framework.