System packages
SSP, assessment evidence and POA&M for each system, kept current from shared evidence.
Packages →- Home
- FISMA and RMF
FISMA and the RMF, on one evidence record
FISMA makes every agency head responsible for protections commensurate with risk, with an independent evaluation every year, and the NIST Risk Management Framework is how that work gets done. NISTcompliance.ai keeps each system's security plan, assessment evidence and POA&M current from shared evidence, so ongoing authorization rests on records that are current.
Runs inside Quzara Cybertorch: FedRAMP Certified, Rev5 Class D (High)SOC 2 Type 2
What NISTcompliance.ai does
Every system, kept current
Continuous monitoring
Continuous monitoring evidence that supports risk decisions after the initial ATO.
Continuous monitoring →Agency continuous assurance
The certification data and reports your FedRAMP cloud providers share, next to your own systems.
Federal agencies →Assessor workspace
Evidence your assessors and inspector general can trace.
Assessor workspace →Managed remediation
Quzara engineers who work the findings queue with you when the date is close.
Managed remediation →RMF steps
The seven RMF steps
Prepare
Get the organization and system ready to manage security and privacy risk.
Categorize
Set the impact level using FIPS 199.
Select
Choose and tailor controls from SP 800-53.
Implement
Put the controls in place and document them.
Assess
Check that the controls work as intended.
Authorize
A senior official makes a risk-based decision to operate.
Monitor
Track the system and controls on an ongoing basis.
Sources: NIST SP 800-37 Rev. 2, NIST RMF. Sources checked Oct 23, 2026. Not a substitute for the official text.
Requirements
What FISMA and OMB require
44 U.S.C. 3554MUST
Agency head responsibility
Each agency head provides security protections commensurate with the risk and magnitude of harm.
44 U.S.C. 3555MUST
Annual independent evaluation
The inspector general, or an independent external auditor, evaluates the agency's program every year.
FISMAMUST
Annual reporting
Agencies report annually to OMB, DHS, certain congressional committees and the Comptroller General.
A-130 App. IMUST
Authorize every system
Complete an initial authorization to operate for each information system and all agency-designated common controls.
A-130 App. IMUST
Move to ongoing authorization
Transition information systems and common controls to an ongoing authorization process when eligible, with the authorizing official's formal approval.
AGU-USE-ABUMUST
Cloud still needs your ATO
Agencies complete the Authorization to Operate process for systems that use FedRAMP Certified cloud offerings.
Sources: GAO Cybersecurity Program Audit Guide, GAO-22-104364, OMB Circular A-130, FedRAMP Agency Use rules. Sources checked Oct 23, 2026. Not a substitute for the official text.
Ongoing authorization
What ongoing authorization rests on
A-130MUST
Transition
Transition information systems and common controls to an ongoing authorization process when eligible, with the authorizing official's formal approval.
A-130FACT
Definition
Ongoing authorization covers the risk determinations and risk acceptance decisions made after the initial authorization.
SP 800-37 Rev. 2SHOULD
Make it a priority
NIST recommends making the transition to ongoing authorization a priority, using continuous monitoring.
SP 800-137FACT
ISCM strategy
Guidance for developing an information security continuous monitoring strategy and program.
SP 800-137AFACT
Assess the program
Guidance for assessing ISCM programs, published May 2020.
CISA CDMFACT
Shared tooling
CISA's Continuous Diagnostics and Mitigation program delivers cybersecurity tools, integration services and dashboards.
Sources: OMB Circular A-130, NIST SP 800-37 Rev. 2, NIST SP 800-137, CISA CDM. Sources checked Oct 23, 2026. Not a substitute for the official text.
FISMA reporting
The FY 2025 reporting cycle under M-25-04
Swipe to see every column
| What | When | Notes |
|---|---|---|
| IG FISMA metrics | Aug 1, 2025 | Core and supplemental metrics |
| Annual CIO, SAOP, IG and agency head reports | Oct 31, 2025 | FY 2025 annual reports |
| CIO metrics | Quarterly and semi-annually | Through CyberScope; only EO metrics are captured quarterly |
| Agency reports to Congress and GAO | Mar 1 of the following year | FY 2024 reports were due Mar 1, 2025 |
Sources: OMB M-25-04. Sources checked Oct 23, 2026. Not a substitute for the official text.
Fiscal year 2026
What changed this year
OIG REPORTSFACT
FY 2025 IG metrics carry over
For FY 2026, the previously approved FY 2025 IG FISMA Reporting Metrics remained in effect, as CIGIE's FY 2026 FISMA audit report notes.
CISAFACT
New CIO metrics
CISA has published FY 2026 and FY 2027 CIO FISMA Metrics, version 1.1, dated September 1, 2026.
Sources: FHFA OIG, Jul 2026, FDIC OIG, Sep 2026, FY 2026 and 2027 CIO FISMA Metrics. Sources checked Oct 23, 2026. Not a substitute for the official text.
Go deeper
RMF guides
NIST SP 800-53 Rev 5 Controls Guide
Control families and how ATO packages use the baselines.
Read the guide →ISSM vs ISSO
Who owns what across the RMF and the ATO.
Read the guide →Questions
Common questions
How is FISMA different from FedRAMP?
FedRAMP certifies cloud offerings for government-wide use. Each agency still authorizes the systems that use those offerings under its own FISMA program, as the FedRAMP Agency Use rules require.
Which version of SP 800-53 is current?
Revision 5, Release 5.2.0, published August 27, 2025. It added controls focused on the security of software updates and patches, and did not change the SP 800-53B baselines.
Is there an SP 800-37 Rev. 3?
No. SP 800-37 Rev. 2, finalized December 20, 2018, is the current revision as of October 2026.
Which OMB memo governs FISMA reporting now?
M-25-04 (January 15, 2025) is the most recent annual guidance memo and rescinded M-24-04. Inspector general reports state that no new instructions were issued for FY 2026.
Book a demo
Keep every package current
We will map your systems and evidence to your next authorization decision.