The Federal Information Security Management Act (FISMA) recommends a framework (developed and maintained by NIST) that is meant to bolster computer and network security within the federal government and affiliated parties. FISMArequires detailed reporting on and measurement of security, with regard to both existing risks and remediation plans. To accurately report on FISMA compliance status, organizations must perform comprehensive validation testing and remediation planning with coordinated reporting and information flow – for every IT system.

Achieving compliance requires an agency-wide approach to information security, including steps like performing inventories of IT assets, analyzing security incidents, and developing processes for reporting and monitoring security incidents. You must define, operationalize, report, audit, and refine security policies via comprehensive collection, correlation, analysis, reporting, and retention of audit events from key applications, security devices, network devices, servers, and desktops.

Lumeta’s Network Assurance solutions provide a complete view of network connectivity on an ongoing basis. With IPsonar, organizations can use this information to create a baseline and subsequent deltas that demonstrate the alignment of policies and controls against network operation reality as the infrastructure evolves.

Lumeta’s Network Assurance solutions map clearly to FISMA recommendations such as:

• Steps 1-4: Categorize, select, supplement, and document
  Ease planning by understanding your complete network topology in advance of network change.
• Step 5: Implement
  Adapt your infrastructure by first creating a network baseline to drive risk out of migration projects and ensure the deployment of a secure network.
• Step 6: Assess
  Assess alignment of security policies and defenses through continual iterations of Network Assurance data scanning.
• Step 7: Authorize
  Utilize executive summary risk scoring for communication to other parts of the organization.
• Step 8: Monitor
  Audit your overall security process with a network risk scorecard and take targeted corrective action to continuously improve your security posture.