FISMA Compliance Handbook

The more that agencies parsed the legislation, the more the challenges worsened.General counsels argued that Congress denuded the agency CIO of any authority orclout when it chose to use the word “ensure” rather than “enforce,” as in “the CIOshall ensure compliance with the act.” Inspectors general were given no guidance onhow to assess an agency’s progress against FISMA mandates, and therefore no twoagencies were reported on consistently. OMB made matters much worse, if that waseven possible, when its implementation guidance over-emphasized scorecards andgrades that could be gamed in many agencies. Thus was born a culture of faking com-pliance while agency security became a sieve. CISO hires came to be based on theability to get a higher compliance grade, and not on any ability to properly managerisk in an enterprise