A recent article concerning how to reform the Federal Information Security Management Act without enacting new legislation caught my attention. This approach disregards the inadequacies of the FISMA legislation and adds naively considered processes to the mountain of processes that clog the agencies’ security arteries. CIOs and CISOs are not authorized to gather this knowledge, because FisMA tragically botched governance, he writes. The CIO and CISO must know the five things they must know before managing the risk and improving the security in a large enterprise.”]
Source: https://www.inforisktoday.com/blogs/questioning-fisma-reform-without-new-law-p-1445