Which of the following created FISMA requirements, requiring System Authorization? Response:

The Federal Information Security Management Act (FISMA) is a United States federal law. Federal laws in the U.S. are created when legislation is passed by both houses of Congress (the Senate and the House of Representatives) and subsequently signed by the President. FISMA was originally enacted as Title III of the E-Government Act of 2002 (Public Law 107-347) and was later updated by the Federal Information Security Modernization Act of 2014 (Public Law 113-283). These acts mandate that federal agencies implement information security programs, a core component of which is the formal authorization of information systems to operate, a process known as System Authorization.

A. DISA: The Defense Information Systems Agency (DISA) is a component of the Department of Defense that develops and enforces security standards (e.g., STIGs) within the DoD, but it does not create federal laws.

B. White House: The White House, through the Office of Management and Budget (OMB), issues circulars and memoranda that provide guidance on how to implement laws like FISMA, but it does not enact the laws themselves.

C. Department of Defense: The Department of Defense (DoD) is an executive branch department that must comply with FISMA. While it develops its own implementation guidance (e.g., DoDI 8510.01), it does not create the overarching federal law.

1. National Institute of Standards and Technology (NIST). (2018). Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy (NIST Special Publication 800-37, Revision 2). Page 127, Appendix G. "The Federal Information Security Management Act (FISMA) of 2002 was passed by Congress as Title III of the E-Government Act of 2002..."

2. U.S. Congress. (2014). Federal Information Security Modernization Act of 2014. Public Law 113-283, 113th Congress. This document is the official text of the law passed by Congress.

3. National Institute of Standards and Technology (NIST). (2020). Security and Privacy Controls for Information Systems and Organizations (NIST Special Publication 800-53, Revision 5). Page 1, Section 1.1. "The Federal Information Security Modernization Act (FISMA) of 2014 requires federal agencies to develop, document, and implement an agency-wide information security program..."