KPMG developed a three-year strategy of audit coverage to satisfy the OIG’s FISMA evaluation requirements

September 19, 2006 FISMA FRAMEWORK Introduction The Federal Information Security Management Act (FISMA) requires that each agency perform an annual, independent evaluation of the information security program and practices of that agency to determine the effectiveness of such program and practices. The Information Technology Committee of the Federal Audit Executive Council (FAEC) has been working on a project to enhance the consistency, comparability and completeness of evaluations performed in response to the requirements of FISMA. The resulting product is a framework for performing the FISMA evaluations. The framework provides an opportunity for the President’s Council on Integrity and Efficiency (PCIE) and the Executive Council on Integrity and Efficiency (ECIE) to endorse an approach designed to assist the Office of Inspector General (OIG) community with: (1) determining the current status of agency security programs through the testing of management and technical controls; (2) assessing management, policies, and guidances; and (3) providing feedback to agency management through the annual evaluation process that will better assist with establishing and achieving improvement goals for information security. The framework is based on Federal information security standards and guidelines developed by the National Institute of Standards and Technology (NIST) and the Office of Management and Budget (OMB). While this framework parallels ...