Scrutineer · By framework

FISMA compliance software for ATO readiness and FISMA requirements

FISMA is not a certification you pass. It is an authorization one agency signs, for one system boundary, and it does not travel to the next agency on its own.

Scrutineer maps your controls to the 800-53 baseline your impact level calls for and keeps the evidence dated, so the package holds up and the authorization survives continuous monitoring.

or try it below ↓

Control-mapped findings · linked evidence · you decide what to remediate

The Scrutiny Desk

Illustrative sample · not an audit attestation

SOC 2 ISO 27001 HIPAA GDPR PCI DSS

Controls in evidence-linked report out

AI scrutinizes you decide

Why it works

What you get with FISMA compliance software

The first question is whether FISMA is even the rule you are under

FISMA reaches information systems used or operated by an agency, or by a contractor on behalf of an agency. That last phrase does the work. If you run a system for an agency, you are inside FISMA and you need an ATO. If you are a defense supplier holding controlled unclassified information on your own network, you are not under FISMA at all: you are under DFARS 252.204-7012, NIST SP 800-171 and CMMC. Teams burn entire quarters building an 800-53 package when the contract actually pointed at 800-171. Scrutineer pins the system to the right regime before you select a single control.

Categorize first, because the baseline follows from it

FIPS 199 sets the impact level from the worst case across confidentiality, integrity and availability. FIPS 200 turns that into minimum requirements, and SP 800-53B turns it into a baseline: roughly speaking a low system carries a fraction of what a high system carries. Categorizing high when moderate was defensible is the single most expensive unforced error in a federal package, because every control you add carries assessment and monitoring cost for the life of the system. Scrutineer holds the categorization rationale next to the controls it drove, so an assessor can see the reasoning rather than guess at it.

An ATO is a start date, not a finish line

The authorization rests on a point-in-time assessment, but the authorizing official accepted risk on the understanding that the controls keep operating. Step seven of the Risk Management Framework is monitor, and an expired scan, an unremediated POA&M item or a stale access review is what turns a signed ATO into a conditional one. Scrutineer pulls proof from your identity, cloud and ticketing systems on a schedule and timestamps it, so the record shows the control ran last quarter as well as this morning.

What it handles

Controls in, an evidence-linked report out

Point Scrutineer at a framework or a vendor and it maps every control, pulls the evidence it can find, flags the gaps and scores the risk, returning a report with linked evidence and a prioritized remediation list. Scrutineer is decision support for readiness, an accredited auditor still issues the attestation.

Determines whether the system is a federal information system under FISMA or a contractor system under NIST 800-171, before any control work starts
Records the FIPS 199 categorization and the rationale behind it, and derives the SP 800-53B baseline from it rather than from a template
Maps your existing controls to the tailored baseline control by control, so a SOC 2 or ISO 27001 program counts toward the federal package
Keeps the System Security Plan aligned with what is actually running, instead of drifting from the day it was written
Tracks POA&M items with owners, milestones and dates, which is the artifact an authorizing official reads most closely
Runs the continuous monitoring cadence the authorization depends on: scanning, access reviews, configuration checks and annual assessment
Holds the evidence an independent assessor samples, dated across the period rather than captured the week before the review
Carries the same evidence base into a FedRAMP package if you later sell the service to more than one agency
Answers the agency security questionnaires and control implementation summaries that arrive with every new task order

FISMA COMPLIANCE SOFTWARE readiness_report

READINESS · 82%

ACCESS CONTROL 91

evidence · MFA enforced and access reviews evidenced.

CHANGE MGMT 78

evidence · Mostly covered; one approval log left untested.

VENDOR RISK 64

evidence · Two subprocessors missing a current review.

ENCRYPTION 86

evidence · Data encrypted in transit and at rest, evidenced.

Example report layout, not customer data

Why Scrutineer

One platform that maps controls and scores risk

Not a static questionnaire, not a pass-fail black box, and not a spreadsheet you maintain by hand. Live control mapping across SOC 2, ISO 27001, HIPAA, GDPR and PCI, automatic evidence and a prioritized gap list, returned as a report you can act on. The AI scrutinizes, you decide.

Mapped to real controls

Every framework is broken down into the controls it actually requires, each scored on a red to amber to green scale, so readiness stays transparent and consistent.

Evidence behind every finding

Each control links to the exact evidence that satisfies it, the policy, the config, the log line, so the finding is auditable and your readiness is defensible.

A prioritized gap list

Open gaps roll up into a ranked remediation list, so the highest-risk findings sit at the top and your team fixes what matters before the audit begins.

Scope reference

Which federal security regime actually binds you, and whether the result carries to the next agency

Most published guidance frames this as a choice between FISMA and FedRAMP, as though they were competing certifications. They are not alternatives, and for a large share of federal contractors neither one applies. What decides your row is who owns the system boundary the data sits in. If you operate a system for an agency, FISMA reaches you and the output is an agency ATO that does not transfer. If federal data sits on your own network, you are almost certainly in the 800-171 world instead. Find your row before you select a single control.

What you are, and where the system sits	What actually binds you	Control baseline	Who issues the authorization artifact	Does it carry to the next agency?
A federal agency operating its own information system	FISMA, 44 U.S.C. Chapter 35, with policy in OMB Circular A-130 and the annual OMB FISMA guidance	NIST SP 800-53, selected from SP 800-53B at the FIPS 199 impact level and the FIPS 200 minimum requirements	The agency authorizing official issues an ATO after an independent assessment	Not applicable. The system is yours, and you also report annually to OMB with an independent Inspector General evaluation.
A contractor operating or hosting an information system on behalf of an agency, cloud or not	FISMA, flowed down through the contract. The statute reaches systems used or operated by a contractor of an agency on behalf of an agency.	The sponsoring agency tailored 800-53 baseline at your impact level, plus any agency-specific overlay	The sponsoring agency authorizing official issues the ATO	No. The ATO is scoped to that agency and that boundary. A second agency starts its own authorization, which is the exact problem FedRAMP was created to solve.
A cloud service provider selling a service to federal agencies	FedRAMP, the government-wide program for cloud services	Historically the 800-53 Rev 5 baselines. Under the Consolidated Rules for 2026 the program expresses requirements as Key Security Indicators, and the old Low, Moderate and High levels are now Certification Classes A through D.	A FedRAMP Certification, signed by the FedRAMP Director on the Program path or by the sponsoring agency on the agency path	Partly, and this is the whole point of the program. The package is reusable from the Marketplace, but every consuming agency still issues its own ATO before it can use the service.
A cloud service sold into the Department of Defense	FedRAMP as the floor, plus the DoD Cloud Computing Security Requirements Guide	The FedRAMP baseline plus the SRG impact level, IL2 through IL6, which adds requirements above the civilian equivalent	A DISA provisional authorization, and then the DoD component mission owner issues its own ATO	No. A provisional authorization is a precondition that lets a mission owner consider you. It is not permission to operate for any given mission.
A defense contractor holding CUI on its own corporate network	Not FISMA. DFARS 252.204-7012 with NIST SP 800-171, assessed under CMMC.	NIST SP 800-171, not 800-53	A self-assessment or a C3PAO certificate depending on the required level, with the score recorded in SPRS	It is not agency-scoped at all. The CMMC status attaches to your organization and its assessed scope, and applies across contracts that require that level.
A civilian agency contractor holding CUI on its own network	Today, whatever the specific agency clause imposes. FAR 52.204-21 covers only federal contract information, with fifteen basic safeguards, and is narrower than most people assume.	Usually 800-171 where an agency clause already calls for it, otherwise the agency own terms	Agency by agency, with no government-wide mechanism yet	A government-wide FAR CUI rule is still proposed rather than final. A revised proposed rule was published on June 23, 2026 at 91 FR 37550 with comments closing July 23, 2026, and it moved suspected CUI incident reporting to 72 hours from the 8 hours originally proposed.
A state or local agency, university or grantee handling federal data	Not FISMA directly. Obligations arrive through the grant, agreement or program terms.	Program specific: IRS Publication 1075 for federal tax information, CMS MARS-E for exchange data, CJIS terms for criminal justice data	The sponsoring federal program office, through its own review or attestation process	No. Each program assesses separately. Cloud vendors selling to state government are usually asked for StateRAMP or GovRAMP instead.

Citations reflect the rules as at August 2026. FedRAMP terminology is in transition: the Consolidated Rules for 2026 took effect in July 2026 and become mandatory on January 1, 2027, renaming a FedRAMP Authorization to a FedRAMP Certification and replacing the Low, Moderate and High impact levels with Certification Classes A through D. FIPS 199 was not renamed, so a federal agency system is still categorized low, moderate or high while a cloud service is now described by class. Much published guidance still equates FedRAMP Moderate with FISMA Moderate using the old terms on both sides. Scrutineer prepares and maintains control evidence. It does not perform assessments, and no vendor can issue an ATO.

Good questions

Questions about FISMA compliance software

FISMA compliance means operating a federal information system under the security program the Federal Information Security Modernization Act requires. In practice that is the NIST Risk Management Framework: categorize the system under FIPS 199, select a control baseline from SP 800-53B, implement it, have it assessed independently, get an authorizing official to sign an Authority to Operate, and then monitor continuously. Agencies also report annually to OMB, and their Inspectors General run an independent evaluation.

Yes, but only for systems operated on behalf of an agency. FISMA covers information systems used or operated by an agency or by a contractor of an agency, so if you run, host or maintain a federal system, the agency pushes its FISMA obligations to you through the contract and your system needs an ATO. If federal data merely sits on your own corporate network, that is usually a controlled unclassified information problem under NIST SP 800-171, not FISMA. The distinction turns on who owns the system boundary.

Federal executive branch agencies and departments, contractors and other organizations operating information systems on their behalf, and any system that collects, processes, stores or transmits federal information in support of an agency mission. It does not directly bind state and local government, private companies handling their own data, or defense suppliers protecting CUI on their own networks, though all three are frequently reached by equivalent requirements flowed down through grants and contracts.

No. FISMA is the statute that requires federal systems to be secured and authorized. FedRAMP is a government-wide program that applies those principles to cloud services so the assessment work can be reused across agencies. The practical difference is reuse: a FISMA ATO is scoped to one agency and one boundary, while a FedRAMP package is designed to be consumed by many agencies, although each agency still issues its own ATO before it can use the service.

There is no such thing, and this is the most common misunderstanding in federal compliance. No agency, auditor or vendor issues a FISMA certificate, and nobody is FISMA certified. The artifact is an Authority to Operate signed by a specific agency official for a specific system, and a different agency reviewing the same system can reach a different decision. Any product marketed as giving you FISMA certification is describing something that does not exist.

It is a law. FISMA was enacted as part of the E-Government Act of 2002 and substantially amended by the Federal Information Security Modernization Act of 2014, and it is codified at 44 U.S.C. Chapter 35. The detail lives elsewhere: OMB Circular A-130 and the annual OMB guidance set policy, and the NIST standards and special publications supply the technical requirements the statute points to.

FISMA moderate describes a system categorized as moderate impact under FIPS 199, meaning a loss of confidentiality, integrity or availability would have a serious adverse effect on operations, assets or individuals. The categorization is a high water mark: the worst rating across the three objectives sets the level for the whole system. Moderate is the most common federal categorization and pulls in a substantially larger SP 800-53B baseline than low.

A high impact system is one where loss of confidentiality, integrity or availability would have a severe or catastrophic effect, typically meaning serious harm to individuals, major financial loss or an inability to perform a primary mission function. High carries the largest 800-53B baseline and the heaviest continuous monitoring load. Because that cost recurs for the life of the system, the categorization decision deserves a documented rationale rather than a cautious default.

An Authority to Operate is the formal decision by an agency authorizing official to accept the residual risk of running a system and permit it to operate. It follows the assessment step of the Risk Management Framework and rests on the System Security Plan, the assessment report and the plan of action and milestones. It is normally time bound or tied to ongoing authorization, and it can be downgraded or withdrawn if monitoring shows the controls stopped working.

Not directly. FISMA binds federal executive branch agencies and those operating systems on their behalf. State and local agencies usually pick up equivalent obligations through the program they participate in: IRS Publication 1075 for federal tax information, CMS MARS-E for health exchange data, or CJIS terms for criminal justice data. Cloud vendors selling to state government are more often asked for StateRAMP or GovRAMP than for a FISMA ATO.

Yes. Defense systems are federal information systems and sit under FISMA, but DoD layers its own implementation on top, historically through the DoD RMF process and, for cloud, the DoD Cloud Computing Security Requirements Guide with its impact levels. A cloud service normally needs a FedRAMP baseline plus a DISA provisional authorization, and then the component mission owner still issues its own ATO. National security systems are handled under a separate authority.

Whatever the contract flows down, which is normally the agency security clause plus a tailored 800-53 baseline at your system impact level. Expect to produce a System Security Plan, support an independent assessment, maintain a POA&M, report incidents on the agency timeline, allow government access for audit and scanning, and take part in continuous monitoring. The obligations survive the award: an ATO that lapses can stop work under the task order.

FISMA itself carries no civil monetary penalty for a private company the way some privacy statutes do. The consequences are contractual and reputational: a denied or withdrawn ATO stops the system operating, a poor Inspector General score becomes public in the annual reporting, and agencies can terminate or decline to renew. Since 2021 the Civil Cyber-Fraud Initiative has also brought False Claims Act cases against contractors that misrepresented their security posture, which is where the real financial exposure now sits.

FISMA is the law that says federal systems must be secured and authorized; NIST SP 800-53 is the control catalog that says what securing them looks like. The statute directs NIST to write the standards and directs agencies to follow them, so in practice a FISMA program is an 800-53 implementation. FIPS 199 and FIPS 200 sit between the two, translating an impact level into the baseline you actually have to implement.

They cover different systems. FISMA governs federal information systems, uses 800-53, and ends in an agency ATO. CMMC governs defense contractor systems holding federal contract information or CUI, uses 800-171, and ends in a self-assessment or a third-party certificate recorded in SPRS. A defense supplier can be under both: 800-171 for its own network, and FISMA for a system it operates for the government.

No. Scrutineer maps your controls to the baseline your system needs, keeps the evidence and the POA&M current, and shows where you stand before an assessment. The assessment is performed by an independent assessor and the authorization decision belongs to the agency authorizing official. We are explicit about that line rather than implying a purchase closes the obligation.

Read every compliance and risk question

Keep reading

Guides that go deeper on federal authorization

FISMA vs FedRAMP: which one actually applies

The reuse question decides it. How many agencies you need to sell to matters more than which framework looks stricter.

Read the guide

FedRAMP 20x vs Rev 5

What the Consolidated Rules for 2026 changed, the retirement runway for Rev 5, and which path to start on today.

Read the guide

GovRAMP and StateRAMP explained

The state and local analogue to FedRAMP, and when a public sector buyer will ask for it instead.

Read the guide

Explore more

More ways to scrutinize compliance and risk with Scrutineer

SOC 2 compliance

Map controls to the Trust Services Criteria, collect evidence, and close gaps before audit.

Learn more

SOC 2 compliance software

A platform that maps SOC 2 controls, automates evidence, and tracks readiness continuously.

Learn more

ISO 27001 compliance

Map your ISMS to Annex A, automate evidence, and stay certification-ready.

Learn more

See every use case See pricing Back to Scrutineer

Stop guessing about readiness. Scrutinize on real evidence.

Point Scrutineer at a framework or a vendor and it maps every control, gathers evidence and scores the risk, returning an evidence-linked report and a prioritized gap list. The AI scrutinizes, you decide.

See pricing

SOC 2, ISO 27001, HIPAA, GDPR & PCI · evidence-linked controls · readiness, not certification