Security Consulting & Compliance
FISMA Compliance
US federal information security controls and continuous monitoring.
Every engagement includes manual validation, a two audience report and free re-testing.
Get a scoped quote+91 96682 00222What this actually is
FISMA governs the security of US federal information systems, and it reaches contractors and sub-contractors handling federal information. If you are in a federal supply chain, the obligation arrives through your contract clauses rather than directly from the statute.
The framework underneath it is NIST: SP 800-53 for controls, SP 800-37 for the risk management framework, and FIPS 199 for categorising the system. Categorisation drives everything else, so getting it wrong is expensive in both directions.
We assess against the applicable control baseline, produce the documentation an authorising official expects, and are honest about which controls are genuinely inherited from your cloud provider and which only look inherited.
What we go after
- System categorisation under FIPS 199 and the boundary it implies
- Control selection from the NIST SP 800-53 baseline for that category
- Control implementation assessed against the actual system
- System Security Plan prepared or reviewed
- Inherited controls from cloud providers, separated from those you own
- Plan of Action and Milestones for every gap
- Continuous monitoring strategy
- Incident response aligned to federal reporting requirements
How we run it
- 01
Gap assessment
We measure you against the standard as it is actually audited, not as it reads on paper.
- 02
Remediation plan
Every gap gets an owner, an effort estimate and a date. You decide what lands this quarter.
- 03
Implement and evidence
We write the policy, build the control and collect the artefact that proves it is working.
- 04
Internal audit
A dry run under audit conditions, so nothing in the real one is a surprise.
- 05
Certify and maintain
We sit on your side of the table for the audit, then keep the evidence current between cycles.
What you receive
- System Security Plan
- Security assessment report against the selected baseline
- Plan of Action and Milestones
- Control inheritance matrix showing what your provider actually covers
- Continuous monitoring plan
- Evidence pack for the authorising official
Who needs this
Contractors and sub-contractors in US federal supply chains, and cloud providers seeking authorisation.
How long it takes
Six to ten weeks for assessment and documentation, driven by system size and how much already exists.
Standards this satisfies
- FISMA
- NIST SP 800-53
- NIST SP 800-37
- FedRAMP
- NIST CSF
Why it matters
Almost nobody starts a certification because they want one. It starts because a customer will not sign without it, a regulator has asked, or a deal is sitting still while procurement waits for evidence. The commercial driver is real and it is worth being honest that it, rather than security, is usually what pays for the programme.
The security benefit is real too, but it comes from a specific place: the discipline of having to evidence that a control operated over a period, rather than that it was configured once. That is the part that changes behaviour, and it is also the part organisations consistently underestimate.
Choose how you want this delivered
Most of the price difference between quotes comes down to this one choice, and it is rarely explained. Pick one to see what it covers, what it suits and what it costs you.
Gap assessment, then we work alongside your team through remediation, internal audit and the certification audit itself. Your people do the work and own the outcome, which is what makes the management system survive after we leave. This is what most organisations should choose.
Choose this when
- You have a team who can absorb the work alongside their day job
- You want the capability to remain in-house afterwards
- First certification where documentation is the main gap
Effort and cost
Moderate. The calendar is longer than a managed programme because the work competes with everyone's existing responsibilities.
Scope it yourself, before you call anyone
Answer a few questions and you get an indicative number, the working behind it and what your answers tell us. It runs in your browser, so nothing you type reaches us.
Which framework are you going for?
What we look for, and keep finding
These are the classes of problem this work exists to surface. Not every engagement finds all of them, but these are the ones that turn up often enough to be worth naming.
Controls that exist on paper only
The policy says quarterly access reviews. The evidence shows one, eighteen months ago, and it was not completed. This is the single most common audit finding across every framework.
Scope drawn too narrowly
A certificate covering a subset of the business that customers assume covers all of it. Auditors check the boundary; buyers rarely do. Getting scope right is the most consequential early decision.
Evidence that cannot be reproduced
A screenshot proves a control was configured on the day someone took it. A framework wants proof it operated throughout the period. Those are very different, and the gap only appears at the audit.
Exceptions with no expiry
Risk accepted once, recorded, and never revisited. Over a few years these accumulate into an undocumented second control framework nobody is managing.
Third parties outside the boundary
Processing carried out by a supplier who was assessed at onboarding and never since, while your obligation for their handling of your data continues regardless.
Who runs your engagement
A lead assessor who has sat on the other side of the table
Compliance work is led by an assessor who has taken organisations through certification, not by a consultant reading the standard for the first time with you. They know which findings a certification body will actually raise, which is a different list from what the standard technically says.
Questions we get asked
Is FISMA the same as FedRAMP?
No. FISMA is the statutory requirement for federal systems; FedRAMP is the standardised authorisation programme for cloud services sold to federal agencies. Both lean on NIST SP 800-53, so the control work overlaps heavily, but the process and the authorising body differ.
Our cloud provider says they are FedRAMP authorised. Are we covered?
Partly, and this is where most programmes go wrong. Their authorisation covers their layer. Everything you build on top is yours, and so is the shared responsibility portion. We separate genuinely inherited controls from those you have merely assumed are inherited.
How does system categorisation affect cost?
Enormously. A moderate baseline carries substantially more controls than a low one, and a high baseline more again. Getting categorisation right at the start is the single biggest cost lever in the whole programme.
Can an Indian company do this work?
For the assessment and documentation, yes, and we do. Where the contract requires assessment by a US based independent assessor or specific personnel citizenship, that constraint is contractual and we will tell you plainly when it applies.
Often scoped alongside
- CERT-In Cyber Security AuditCERT-In empanelled audit and certification for government and regulated entities.Read more
- ISO 27001 Audit & CertificationISMS design, implementation, internal audit and certification support end to end.Read more
- ISO 27017 Compliance AuditCloud-specific security controls for providers and customers.Read more
- ISO 27018 Compliance AuditProtection of personally identifiable information in public clouds.Read more
Ready to scope your fisma compliance?
Thirty minutes with a senior engineer, and you leave with a written scope and indicative effort.