Federal Information Security Modernization Act
The Federal Information Security Modernization Act of 2014 (FISMA) requires each agency’s Inspector General (IG) to conduct an annual independent evaluation to determine the effectiveness of the information security program (ISP) and practices of its respective agency. Our audit scope was limited to answering the fiscal year (FY) 2025 IG metrics, which include 20 core and 5 supplemental IG metrics. The FISMA methodology considers metrics at a maturity level 4 (managed and measurable) or higher to be at an effective level of security.