Update, C&A, FISMA

The auditors we hired to perform our external Security Test and Evaluation for our C&A were onsite last week for the second phase of their testing. Things seem good and we await their final report.

I was at the University of California Information Technology Policy and Security in Santa Cruz last week. Among other interesting topics, some early discussion about the security and policy implications of dedicated on-demand connections of the kind being proposed throughout the R&E community turned out to be very interesting. Steve Lau and I gave a presentation about NIST and did some theorizing about the misapplication of FISMA to University grants and government partnerships. If you listen to my interview at Educause 2005, you can hear the outline of the problem we are seeing.

Basically, as agencies like the VA get into trouble you see broader (and improper) reading of the FISMA "on behalf of" and "government information" definitions, which are so overly broad as to trigger the FISMA requirements in pretty much any situation in which the government is involved (including research grants). This presents a situation where you might end up doing Certification and Accreditation type processes under small University research environments simply because they receive Federal funds. Not good.