Federal Government Cybersecurity: FISMA, CIRCIA, and FedRAMP

Federal government cybersecurity laws center on two statutes — the Federal Information Security Modernization Act (FISMA) and the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) — supported by executive orders, NIST technical standards, and contractor-specific programs like FedRAMP and CMMC. Together they set what federal agencies must do to secure their own systems, what private operators of critical infrastructure must report when they are attacked, and what companies selling to the government must prove before they get paid. The framework is enforced through a mix of Office of Management and Budget oversight, CISA operational directives, and Department of Justice actions under the False Claims Act.

The Two Core Statutes

FISMA: What Federal Agencies Must Do

FISMA, codified at 44 U.S.C. §§ 3551–3559, is the backbone law. It requires every federal agency to build and maintain an agency-wide information security program covering all systems that support its operations, including systems run by contractors on the agency’s behalf.¹ Each program must include risk assessments, security awareness training for employees and contractors, annual testing of security controls, and documented procedures for detecting and responding to incidents. The statute treats security as continuous rather than a one-time certification: agencies have to reassess and update as threats evolve.

FISMA also splits oversight so no single entity grades its own work. The Director of OMB oversees agency security policies and practices, including timely adoption of standards developed by the National Institute of Standards and Technology.² Agencies implement, NIST writes the standards, OMB enforces.

CIRCIA: What Critical Infrastructure Operators Must Report

CIRCIA, enacted in 2022 and codified at 6 U.S.C. §§ 681–681g, pushes federal cybersecurity requirements out to private companies operating critical infrastructure in sectors like energy, finance, healthcare, and communications. Covered entities must report significant cyber incidents to CISA within 72 hours of reasonably believing an incident has occurred, and any ransomware payment within 24 hours of making it.³

One planning detail matters here. The statutory timelines exist now, but CISA’s implementing regulations — which will define exactly which entities are “covered” and what qualifies as a “covered cyber incident” — are expected to be finalized in 2026.⁴ Until then, the precise scope remains open for many private-sector organizations. Companies in critical infrastructure sectors should be building reporting procedures now, because retroactive compliance will be harder than preparing in advance.

Executive Order 14028 and Zero Trust

Executive Order 14028, issued in May 2021, drove the biggest operational shift in federal cybersecurity in years by directing agencies to adopt a Zero Trust Architecture. The older model trusted anything already inside the network perimeter. Zero Trust reverses that assumption: no user, device, or connection is inherently trusted, and every access request has to be verified. OMB Memorandum M-22-09 translated the directive into specific requirements, including mandatory multi-factor authentication and encryption of all network traffic.⁵

The order also addressed software supply chain risk by requiring vendors selling to the government to provide a Software Bill of Materials, essentially an ingredient list cataloging every component and third-party library in the product. Agencies can then quickly check whether they are running software affected by a newly disclosed vulnerability instead of waiting for the vendor to say so.⁶ EO 14028 removed contractual barriers that had discouraged IT service providers from sharing breach data with the government as well.

The order remains in effect. A follow-up order (EO 14144) issued in January 2025 sought to expand on it, but many of its initiatives were not taken up by the incoming Trump administration, which made targeted edits to prior cybersecurity orders rather than repealing them wholesale.⁷

Which Agencies Run What

Three federal bodies do most of the work, and knowing which one owns a given requirement is the fastest way to figure out where a rule comes from.

CISA is the national coordinator for critical infrastructure security and resilience, a role formalized through the National Defense Authorization Act and a National Security Memorandum that put DHS in the lead.⁸ CISA receives incident reports, issues threat alerts, provides direct technical assistance, maintains the Known Exploited Vulnerabilities Catalog, and can issue binding operational directives forcing federal agencies to patch within a set window.

NIST writes the technical standards that federal regulations reference. Its most influential product is the Cybersecurity Framework 2.0, which organizes cybersecurity outcomes around six functions: Govern, Identify, Protect, Detect, Respond, and Recover.⁹ The framework itself is voluntary, but FISMA requirements, CMMC assessments, and FedRAMP authorizations all point back to it, so understanding its categories is effectively a prerequisite for compliance work. NIST has no enforcement power of its own.

OMB holds statutory authority to oversee agency compliance with FISMA and NIST standards, reviews agency budgets and performance metrics, and can enforce consequences when agencies fall short.²

What Federal Contractors Have to Meet

FedRAMP for Cloud Providers

Any cloud service provider selling to a federal agency must be authorized under the Federal Risk and Authorization Management Program, which standardizes the security assessment of cloud products.¹⁰ The FedRAMP Authorization Act, signed in 2022 and codified starting at 44 U.S.C. § 3607, gave the program a statutory foundation and created a FedRAMP Board that sets and updates authorization requirements in line with NIST standards.¹¹ The process involves a rigorous third-party assessment, and an authorization can be reused across agencies rather than earned separately for each contract.

CMMC for Defense Contractors

The Cybersecurity Maturity Model Certification program, codified at 32 CFR Part 170, applies to the defense industrial base.¹² Defense contractors and subcontractors handling Federal Contract Information or Controlled Unclassified Information must achieve a specific CMMC level as a condition of contract award. The program is rolling out in phases:

Phase 1, November 2025 through November 2026: solicitations require CMMC Level 1 or Level 2 self-assessments. DoD may also include Level 2 third-party certification requirements in some Phase 1 procurements.
Phase 2, beginning November 2026: solicitations will require Level 2 certification through an independent third-party assessment organization.
Phase 3 and full implementation, beginning November 2027: solicitations will require Level 3 certification for contracts involving the most sensitive information.

DoD has reserved the right to pull Level 2 certification requirements into Phase 1 procurements, so contractors relying on self-assessment should not treat it as the ceiling.¹³

NIST SP 800-171 and Self-Assessment Scores

At the core of CMMC compliance sits NIST Special Publication 800-171, which sets the security requirements for protecting Controlled Unclassified Information in nonfederal systems. It covers access control, incident response, audit and accountability, and dozens of other requirements.¹⁴ Defense contractors self-assess against those requirements using DoD’s assessment methodology and upload their scores to the Supplier Performance Risk System, a federal database that contracting officers check before awarding contracts.¹⁵ A low score does not automatically disqualify a contractor, but it signals risk that can influence award decisions. For higher-stakes contracts, an independent auditor verifies the controls rather than relying on the contractor’s own assessment.

Enforcement Through the False Claims Act

The Department of Justice launched its Civil Cyber-Fraud Initiative in October 2021, using the False Claims Act to pursue contractors and grant recipients who misrepresent their cybersecurity posture to the government. The Act imposes liability on anyone who knowingly submits a false claim for payment, with penalties of three times the government’s damages plus per-claim penalties that currently exceed $13,000 each after inflation adjustments.¹⁶ “Knowingly” is the operative word: the contractor does not need to intend fraud, just to have submitted claims while aware that its cybersecurity representations were inaccurate.

The initiative targets three categories: failing to comply with contractual cybersecurity standards, misrepresenting security controls during contracting, and failing to report suspected breaches on time. DOJ reported recovering $52 million across nine cybersecurity-related False Claims Act settlements in 2025, with 15 total settlements since the initiative launched. Enforcement is not limited to breaches that actually happened. A contractor that claims NIST SP 800-171 compliance in its self-assessment without having implemented the controls faces liability whether or not any data was compromised. The Act’s qui tam provisions also let whistleblowers file suit on the government’s behalf, giving insiders a financial incentive to report corner-cutting.

Incident Reporting: The Clock and the Sanctions Trap

Once a covered entity under CIRCIA reasonably believes it has experienced a covered cyber incident, the 72-hour reporting window starts running. For ransomware payments, the window is 24 hours from the time payment is made.³ Reports go to CISA and must describe the nature of the attack and the systems affected. The organization receives a tracking number, and federal investigators may follow up for additional technical data or to offer mitigation assistance. Information reported is protected and used for threat analysis rather than as a basis for regulatory enforcement against the reporter, a design choice meant to encourage honest reporting.¹⁷

Ransomware brings a separate risk beyond the payment itself. The Treasury Department’s Office of Foreign Assets Control has warned that paying ransom to a sanctioned entity can trigger civil penalties under strict liability, meaning you can be held liable even if you had no idea the attacker was on a sanctions list.¹⁸ OFAC provides a license process for otherwise-prohibited transactions, but working through it during an active ransomware crisis adds days. Incident response plans should include legal counsel who understands sanctions law, not just technical recovery.

What’s Coming: Post-Quantum Cryptography

Quantum computing is the next major concern because sufficiently powerful quantum computers could break the encryption that currently protects classified and unclassified government communications. National Security Memorandum 10 directs federal agencies to inventory their cryptographic systems and develop timelines for transitioning to quantum-resistant algorithms. NIST finalized its first set of post-quantum cryptography standards in August 2024, including algorithms for digital signatures and key encapsulation designed to resist quantum attacks.¹⁹

The transition schedule is still forming. Agencies must submit annual prioritized inventories of their cryptographic systems along with migration cost estimates, but no single completion deadline has been published. Cryptographic algorithms sit inside virtually every federal system, from email to weapons platforms, and replacing them takes both software updates and, in some cases, hardware changes. Organizations that work with the federal government should be tracking the post-quantum standards now, because contracts will eventually require compliance and the lead time for overhauling cryptographic infrastructure runs to years.

1
Office of the Law Revision Counsel. 44 U.S. Code 3554 – Federal Agency Responsibilities
2
Office of the Law Revision Counsel. 44 U.S. Code 3553 – Authority and Functions of the Director and the Secretary
3
Office of the Law Revision Counsel. 6 U.S. Code 681b – Cyber Incident Reporting
4
Reginfo.gov. View Rule – CIRCIA Reporting Requirements
5
Office of Management and Budget. M-22-09 – Moving the U.S. Government Toward Zero Trust Cybersecurity Principles
6
National Institute of Standards and Technology. Software Security in Supply Chains – Software Bill of Materials
7
Congressional Research Service. Changes to National Cyber Policy in the Trump Administration
8
Cybersecurity and Infrastructure Security Agency. National Security Memorandum on Critical Infrastructure Security and Resilience
9
National Institute of Standards and Technology. NIST Cybersecurity Framework (CSF) 2.0
10
GSA. FedRAMP
11
Office of the Law Revision Counsel. 44 U.S. Code 3610 – FedRAMP Board
12
eCFR. 32 CFR Part 170 – Cybersecurity Maturity Model Certification Program
13
Department of Defense CIO. About CMMC
14
Computer Security Resource Center. NIST SP 800-171 Rev. 3 – Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations
15
Department of Defense. NIST SP 800-171 DoD Assessment Methodology
16
Office of the Law Revision Counsel. 31 U.S. Code 3729 – False Claims
17
Cybersecurity and Infrastructure Security Agency. Cyber Incident Reporting for Critical Infrastructure Act of 2022
18
U.S. Department of the Treasury. Cyber-Related Sanctions
19
Computer Security Resource Center. FIPS 204 – Module-Lattice-Based Digital Signature Standard