Search | CMS Information Security and Privacy Program

Skip to main content

General Information
CMS Information Security Advisory Board (CISAB)
A volunteer board comprised of ISPG staff and the ISSO community designed to promote collaboration on cybersecurity and privacy issues
What is the CMS Information Security Advisory Board (CISAB)? The …
General Information
Ongoing Authorization (OA)
Supporting the continuous compliance and safety of FISMA systems through proactive, ongoing monitoring activities
What is Ongoing Authorization (OA)? All FISMA systems must be …
Tools / Services
ISSO As A Service
ISPG program that provides skilled Information System Security Officers (ISSOs) to CMS components in need of professional security and privacy support
What is ISSO As A Service (ISSOaaS)? Information System Security …
Topic Page
System Authorization
Testing and documenting of security compliance requirements for FISMA systems at CMS, so they can be authorized to operate
To ensure the security of data handled by government agencies …
General Information
Security Impact Analysis (SIA)
A process to determine the effect(s) a change can cause to the security posture of a FISMA system
What is a Security Impact Analysis (SIA) A Security Impact …
General Information
ISSO Appointment Letter
An official document that outlines the responsibilities to be completed by the ISSO on behalf of a specific FISMA System
What is the ISSO Appointment Letter? The Information System Security …
Tools / Services
Continuous Diagnostics and Mitigation (CDM)
Automated scanning and risk analysis to strengthen the security posture of CMS FISMA systems
What is Continuous Diagnostics and Mitigation (CDM)? Continuous Diagnostics and …
General Information
System Security and Privacy Plan (SSPP)
Documentation of a FISMA system’s features and security requirements, along with controls and procedures for information protection
What is a System Security and Privacy Plan (SSPP)? The …
General Information
CMS Interconnection Security Agreement (ISA)
Defining the relationship between CMS information systems and external systems
What is an Interconnection Security Agreement (ISA)? An Interconnection Security …
General Information
Security Controls Assessment (SCA)
A compliance-based assessment to determine if a system's security and privacy controls are implemented correctly
What is a Security Control Assessment (SCA)? The Security Control …