FISMA is the U.S. law that requires what?

FISMA is the U.S. law that requires what?

• A. Federal agencies to implement information security programs
• B. Banks to report quarterly profits
• C. Individuals to use two-factor authentication
• D. Businesses to encrypt all emails

Answer: (A)

FISMA requires federal agencies to implement information security programs. It Establishes that government bodies must create, document, and maintain an information security program to protect their information and information systems, including conducting risk assessments, applying security controls, and continuously monitoring and reporting on security posture. The framework commonly references NIST guidelines (like SP 800-53) and a risk-management approach to authorize and sustain secure systems. This isn’t about banks’ profits, or individuals needing two-factor authentication, or businesses encrypting all emails. Those topics fall outside FISMA’s scope, which targets the security management practices of federal agencies and their information systems.

FISMA requires federal agencies to implement information security programs. It Establishes that government bodies must create, document, and maintain an information security program to protect their information and information systems, including conducting risk assessments, applying security controls, and continuously monitoring and reporting on security posture. The framework commonly references NIST guidelines (like SP 800-53) and a risk-management approach to authorize and sustain secure systems.

This isn’t about banks’ profits, or individuals needing two-factor authentication, or businesses encrypting all emails. Those topics fall outside FISMA’s scope, which targets the security management practices of federal agencies and their information systems.