The Compliance Imperative
Information security at federal agencies is driven by key mandates, including the Federal Information Security Management ACT of 2002, or FISMA. FISMA created a framework of security requirements based on continuously evolving standards. Federal agencies must comply with these rules and report on the effectiveness of their IT security programs to the OMB and Congress. The Department of Defense also requires all DoD-owned or controlled information systems to submit to the Defense Information Assurance Certification and Accreditation Process (DIACAP). This dynamic process requires DoD agencies and commands to review and update their information assurance posture annually. The focus of the DIACAP process encourages agencies to rely on automated tools and flexible, modular, and continuous monitoring of information systems. With a majority of attacks focused at the application level, application security is increasingly critical to achieving FISMA, DIACAP, and Security Technical Implementation Guide (STIG) compliance..
New Standards, New Threats
Faced by an ever-growing matrix of threats, the federal government has tasked the National Institute for Standards and Technology (NIST) with developing and refining federal security standards. NIST emphasizes an enterprise-wide risk management approach and has developed a Risk Management Framework to guide agencies in meeting this goal. Recognizing the threat to application security, the first three steps of this process focus on the front-end, directing agencies to build security into information technology products and systems early in the system development lifecycle. According to NIST, “better front-end security results in fewer weaknesses and deficiencies in information systems, directly translating to a lesser number of vulnerabilities that can be exploited by threat sources.”
Achieve FISMA Compliance with CA Veracode
As an expert in application security, CA Veracode is in a unique position to provide an independent assessment and standards-based rating to ensure your applications comply with FISMA rules. CA Veracode helps agencies rapidly achieve FISMA compliance in a simple and cost effective way. CA Veracode’s automated on-demand service allows agencies to conduct application security testing on an as-needed basis and without the need for costly tools or time intensive consultative engagements. With no hardware or software to buy, install, maintain, or upgrade, agencies drastically reduce both their capital and operational expenses related to FISMA compliance. CA Veracode is also uniquely positioned to provide an independent assessment and standards-based rating to ensure your applications successfully meet the DIACAP and STIG process. With no hardware or software to buy, install, maintain, or upgrade, agencies can drastically reduce both their capital and operational expenses related to DIACAP.