House committee approves FISMA reform

Legislative reform of the Federal Information Security Management Act came one step closer to reality May 20 when the House Oversight and Government Reform Committee approved a bill requiring continuous cybersecurity automated monitoring.

FISMA has long come under criticism that its certification and accreditation processes and reporting requirements make agency cybersecurity mostly a paper exercise. The Office of Management and Budget itself has moved to change cybersecurity guidance to include more emphasis on real-time reporting.

The bill, Federal Information Security Amendments Act of 2010, would also establish a White House office of cyberspace headed by a Senate-confirmed director to oversee civilian agency cybersecurity practices. The Defense Department and the CIA would be exempt from the cybersecurity director's powers, which would include approval of agency cybersecurity programs.

The bill would also establish a federal cybersecurity practice board within the director's office. Additionally, the agency would have to undergo an annual independent audit of their information security program.

The bill also includes a title that would legislatively establish the position of federal chief technology officer and create a separate office for the CTO. The position would not require Senate confirmation under the bill language approved by the House committee. Aneesh Chopra, the current federal CTO, works within the White House Office of Science and Technology Policy but he was confirmed by the Senate.

For more:
- read the House committee-approved text, H.R. 4900 (.pdf)

Related Articles:
Congressional cybersecurity bill roundup UPDATED
NASA moves away from C&A on IT systems
OMB gives DHS new powers under revised FISMA guidance