{"id":20967,"date":"2018-08-16T01:31:46","date_gmt":"2018-08-16T01:31:46","guid":{"rendered":"https:\/\/one.sightlinemg.com\/federaltimes\/uncategorized\/2018\/08\/16\/when-fisma-isnt-enough\/"},"modified":"2026-08-08T04:49:29","modified_gmt":"2026-08-08T04:49:29","slug":"when-fisma-isnt-enough","status":"publish","type":"post","link":"https:\/\/one.sightlinemg.com\/federaltimes\/opinions\/2018\/08\/16\/when-fisma-isnt-enough\/","title":{"rendered":"When FISMA isn\u2019t enough"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><i>This is part two in a multipart commentary on supply chain security. For part one, <\/i><a href=\"https:\/\/www.federaltimes.com\/opinions\/2018\/08\/13\/federal-supply-chain-threats-quietly-growing\/\" target=_blank><i>click here<\/i><\/a><i>.<\/i><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Federal departments and agencies are obligated by the Federal Information Security Modernization Act to protect the confidentiality, integrity and availability of defined categories of federal information (\u201ccontrolled unclassified information,\u201d or CUI) and information systems that host, process or transmit that information. But it\u2019s often not enough to secure the federal supply chain against software threats and cyber-physical dangers.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">FISMA is directed to protect against network and information system attacks that can compromise federal CUI. Present federal efforts give comparatively little attention to cyber-physical threats, such as corruption of firmware or other types of software that produce unwanted and adverse effects on connected equipment. Measures intended to protect IT, even where successful, may do little to secure operational technology.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Spurred by Congress, DoD requires its larger contractors to implement systems and procedures to detect and avoid counterfeit electronic parts. On its own initiative, DoD has implemented DFARS procurement regulations and contract requirements to make all DoD suppliers safeguard controlled technical information of military or space significance and other CUI types, using NIST security principles.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">DoD\u2019s acts concern the risk that the supply chain might deliver counterfeit parts and the cyber threat to the confidentiality of information and information systems that host CTI and other forms of CUI. To protect contractor information systems against network-delivered attacks, DoD requires contractors to employ the 110 safeguards of NIST Special Publication 800-171.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The present challenge is to identify, detect, defend against, respond to or recover from software-delivered cyber-physical attacks on operational technology \u2013 for example, industrial control systems, supervisory control and data acquisition, programmable logic controllers and other systems that operate manufacturing facilities and infrastructure. SP 800-171 is not intended to protect these systems.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Civilian departments have done less than DoD against supply chain threats. For years, civilian agencies have considered a counterpart to the DoD \u201ccyber DFARS\u201d to require protection of CUI when shared with non-federal entities. There currently is no such regulation or requirement, but an inter-agency effort is proceeding that may produce a regulation, like the \u201ccyber DFARS,\u201d requiring use of NIST SP 800-171 safeguards by non-federal entities to protect all CUI they receive it from a federal agency.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">DoD presently has special authorities, to avoid counterfeit electronics and exclude high risk sources, not available to all federal departments and agencies. Generally, civilian agencies take no regular and direct measures, beyond ordinary quality and conformance requirements, to require suppliers or service providers to secure their supply chains or to report and remedy supply-chain attacks. But adversaries will not limit hostile activities to the defense sector.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The president\u2019s executive order from May 11, 2017, holds heads of executive departments accountable for managing cybersecurity risk to their enterprises and calls on the executive branch to support the cybersecurity efforts of the owners and operators of critical infrastructure. It further requires a report on the cybersecurity risks facing the defense industrial base, including its supply chain. These are commendable in intent, but more policies, efforts and reports do not produce objective improvements in security, nor do they necessarily change the security practices of commercial enterprises.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It\u2019s critical to recognize threats to private industry affect government interests. Federal action on cyber and supply chain threats focus upon federal information systems and contractors for supplies, systems or services. Attacks upon utilities or transportation facilities, or other aspects of critical infrastructure can produce discomfort, inconvenience, economic loss, property damage or even personal injury or death. Attacks upon civil logistics providers, even where facilities are located in the continental United States, can inflict damage on defense business and erode the ability of commanders to deploy forces and execute missions on foreign soil.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><i>Robert Metzger is a shareholder of the law firm of Rogers, Joseph O\u2019Donnell, PC and head of the firm\u2019s office in Washington, D.C. As a special government employee of the Department of Defense, he was a member of the Defense Science Board (DSB) Task Force that produced the Cyber Supply Chain Report in 2017. He is active in other public-private initiatives, including cyber and supply chain security work for the MITRE Corporation.<\/i><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Federal agencies, especially civilian organizations, aren&#8217;t going far enough to secure against cyber-physical threats to the supply chain.<\/p>\n","protected":false},"author":7,"featured_media":31055,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":26,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":[]},"categories":[106,31,110,33,26],"tags":[],"coauthors":[2744],"class_list":["post-20967","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-daily-brief","category-home","category-it-cloud-report","category-newsletters","category-opinions"],"acf":{"subheadline":"","legacy_arc_id":"CKVIJBXYTRBP7PHVOJM24KYTVE","arc_canonical_url":"\/opinions\/2018\/08\/16\/when-fisma-isnt-enough\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.0 (Yoast SEO v28.1) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>When FISMA isn\u2019t enough - Federal Times<\/title>\n<meta name=\"description\" content=\"Federal agencies, especially civilian organizations, aren&#039;t going far enough to secure against cyber-physical threats to the supply chain.\" \/>\n<meta name=\"robots\" content=\"noindex, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"When FISMA isn\u2019t enough\" \/>\n<meta property=\"og:description\" content=\"Federal agencies, especially civilian organizations, aren&#039;t going far enough to secure against cyber-physical threats to the supply chain.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/one.sightlinemg.com\/federaltimes\/opinions\/2018\/08\/16\/when-fisma-isnt-enough\/\" \/>\n<meta property=\"og:site_name\" content=\"Federal Times\" \/>\n<meta property=\"article:published_time\" content=\"2018-08-16T01:31:46+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-08-08T04:49:29+00:00\" \/>\n<meta name=\"author\" content=\"Robert Metzger\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Robert Metzger\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\n\t    \"@context\": \"https:\\\/\\\/schema.org\",\n\t    \"@graph\": [\n\t        {\n\t            \"@type\": \"Article\",\n\t            \"@id\": \"https:\\\/\\\/one.sightlinemg.com\\\/federaltimes\\\/opinions\\\/2018\\\/08\\\/16\\\/when-fisma-isnt-enough\\\/#article\",\n\t            \"isPartOf\": {\n\t                \"@id\": \"https:\\\/\\\/one.sightlinemg.com\\\/federaltimes\\\/opinions\\\/2018\\\/08\\\/16\\\/when-fisma-isnt-enough\\\/\"\n\t            },\n\t            \"author\": {\n\t                \"name\": \"migration\",\n\t                \"@id\": \"https:\\\/\\\/one.sightlinemg.com\\\/federaltimes\\\/#\\\/schema\\\/person\\\/cc76c831bb37a926738c8391fca7a3b1\"\n\t            },\n\t            \"headline\": \"When FISMA isn\u2019t enough\",\n\t            \"datePublished\": \"2018-08-16T01:31:46+00:00\",\n\t            \"dateModified\": \"2026-08-08T04:49:29+00:00\",\n\t            \"mainEntityOfPage\": {\n\t                \"@id\": \"https:\\\/\\\/one.sightlinemg.com\\\/federaltimes\\\/opinions\\\/2018\\\/08\\\/16\\\/when-fisma-isnt-enough\\\/\"\n\t            },\n\t            \"wordCount\": 699,\n\t            \"commentCount\": 0,\n\t            \"publisher\": {\n\t                \"@id\": \"https:\\\/\\\/one.sightlinemg.com\\\/federaltimes\\\/#organization\"\n\t            },\n\t            \"image\": {\n\t                \"@id\": \"https:\\\/\\\/one.sightlinemg.com\\\/federaltimes\\\/opinions\\\/2018\\\/08\\\/16\\\/when-fisma-isnt-enough\\\/#primaryimage\"\n\t            },\n\t            \"thumbnailUrl\": \"https:\\\/\\\/one.sightlinemg.com\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/AP17284678637366.jpg.jpg\",\n\t            \"articleSection\": [\n\t                \"Daily Brief\",\n\t                \"Home\",\n\t                \"IT &amp; Cloud Report\",\n\t                \"Newsletters\",\n\t                \"Opinion\"\n\t            ],\n\t            \"inLanguage\": \"en-US\",\n\t            \"potentialAction\": [\n\t                {\n\t                    \"@type\": \"CommentAction\",\n\t                    \"name\": \"Comment\",\n\t                    \"target\": [\n\t                        \"https:\\\/\\\/one.sightlinemg.com\\\/federaltimes\\\/opinions\\\/2018\\\/08\\\/16\\\/when-fisma-isnt-enough\\\/#respond\"\n\t                    ]\n\t                }\n\t            ]\n\t        },\n\t        {\n\t            \"@type\": \"WebPage\",\n\t            \"@id\": \"https:\\\/\\\/one.sightlinemg.com\\\/federaltimes\\\/opinions\\\/2018\\\/08\\\/16\\\/when-fisma-isnt-enough\\\/\",\n\t            \"url\": \"https:\\\/\\\/one.sightlinemg.com\\\/federaltimes\\\/opinions\\\/2018\\\/08\\\/16\\\/when-fisma-isnt-enough\\\/\",\n\t            \"name\": \"When FISMA isn\u2019t enough - Federal Times\",\n\t            \"isPartOf\": {\n\t                \"@id\": \"https:\\\/\\\/one.sightlinemg.com\\\/federaltimes\\\/#website\"\n\t            },\n\t            \"primaryImageOfPage\": {\n\t                \"@id\": \"https:\\\/\\\/one.sightlinemg.com\\\/federaltimes\\\/opinions\\\/2018\\\/08\\\/16\\\/when-fisma-isnt-enough\\\/#primaryimage\"\n\t            },\n\t            \"image\": {\n\t                \"@id\": \"https:\\\/\\\/one.sightlinemg.com\\\/federaltimes\\\/opinions\\\/2018\\\/08\\\/16\\\/when-fisma-isnt-enough\\\/#primaryimage\"\n\t            },\n\t            \"thumbnailUrl\": \"https:\\\/\\\/one.sightlinemg.com\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/AP17284678637366.jpg.jpg\",\n\t            \"datePublished\": \"2018-08-16T01:31:46+00:00\",\n\t            \"dateModified\": \"2026-08-08T04:49:29+00:00\",\n\t            \"description\": \"Federal agencies, especially civilian organizations, aren't going far enough to secure against cyber-physical threats to the supply chain.\",\n\t            \"breadcrumb\": {\n\t                \"@id\": \"https:\\\/\\\/one.sightlinemg.com\\\/federaltimes\\\/opinions\\\/2018\\\/08\\\/16\\\/when-fisma-isnt-enough\\\/#breadcrumb\"\n\t            },\n\t            \"inLanguage\": \"en-US\",\n\t            \"potentialAction\": [\n\t                {\n\t                    \"@type\": \"ReadAction\",\n\t                    \"target\": [\n\t                        \"https:\\\/\\\/one.sightlinemg.com\\\/federaltimes\\\/opinions\\\/2018\\\/08\\\/16\\\/when-fisma-isnt-enough\\\/\"\n\t                    ]\n\t                }\n\t            ]\n\t        },\n\t        {\n\t            \"@type\": \"ImageObject\",\n\t            \"inLanguage\": \"en-US\",\n\t            \"@id\": \"https:\\\/\\\/one.sightlinemg.com\\\/federaltimes\\\/opinions\\\/2018\\\/08\\\/16\\\/when-fisma-isnt-enough\\\/#primaryimage\",\n\t            \"url\": \"https:\\\/\\\/one.sightlinemg.com\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/AP17284678637366.jpg.jpg\",\n\t            \"contentUrl\": \"https:\\\/\\\/one.sightlinemg.com\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/AP17284678637366.jpg.jpg\"\n\t        },\n\t        {\n\t            \"@type\": \"BreadcrumbList\",\n\t            \"@id\": \"https:\\\/\\\/one.sightlinemg.com\\\/federaltimes\\\/opinions\\\/2018\\\/08\\\/16\\\/when-fisma-isnt-enough\\\/#breadcrumb\",\n\t            \"itemListElement\": [\n\t                {\n\t                    \"@type\": \"ListItem\",\n\t                    \"position\": 1,\n\t                    \"name\": \"Home\",\n\t                    \"item\": \"https:\\\/\\\/one.sightlinemg.com\\\/federaltimes\\\/\",\n\t                    \"ad_zone\": \"home\"\n\t                },\n\t                {\n\t                    \"@type\": \"ListItem\",\n\t                    \"position\": 2,\n\t                    \"name\": \"Opinion\",\n\t                    \"item\": \"https:\\\/\\\/one.sightlinemg.com\\\/federaltimes\\\/opinions\\\/\",\n\t                    \"ad_zone\": \"opinions\"\n\t                },\n\t                {\n\t                    \"@type\": \"ListItem\",\n\t                    \"position\": 3,\n\t                    \"name\": \"When FISMA isn\u2019t enough\"\n\t                }\n\t            ]\n\t        },\n\t        {\n\t            \"@type\": \"WebSite\",\n\t            \"@id\": \"https:\\\/\\\/one.sightlinemg.com\\\/federaltimes\\\/#website\",\n\t            \"url\": \"https:\\\/\\\/one.sightlinemg.com\\\/federaltimes\\\/\",\n\t            \"name\": \"Federal Times\",\n\t            \"description\": \"Federal Times\",\n\t            \"publisher\": {\n\t                \"@id\": \"https:\\\/\\\/one.sightlinemg.com\\\/federaltimes\\\/#organization\"\n\t            },\n\t            \"potentialAction\": [\n\t                {\n\t                    \"@type\": \"SearchAction\",\n\t                    \"target\": {\n\t                        \"@type\": \"EntryPoint\",\n\t                        \"urlTemplate\": \"https:\\\/\\\/one.sightlinemg.com\\\/federaltimes\\\/?s={search_term_string}\"\n\t                    },\n\t                    \"query-input\": {\n\t                        \"@type\": \"PropertyValueSpecification\",\n\t                        \"valueRequired\": true,\n\t                        \"valueName\": \"search_term_string\"\n\t                    }\n\t                }\n\t            ],\n\t            \"inLanguage\": \"en-US\"\n\t        },\n\t        {\n\t            \"@type\": \"Organization\",\n\t            \"@id\": \"https:\\\/\\\/one.sightlinemg.com\\\/federaltimes\\\/#organization\",\n\t            \"name\": \"Federal Times\",\n\t            \"url\": \"https:\\\/\\\/one.sightlinemg.com\\\/federaltimes\\\/\",\n\t            \"logo\": {\n\t                \"@type\": \"ImageObject\",\n\t                \"inLanguage\": \"en-US\",\n\t                \"@id\": \"https:\\\/\\\/one.sightlinemg.com\\\/federaltimes\\\/#\\\/schema\\\/logo\\\/image\\\/\",\n\t                \"url\": \"https:\\\/\\\/one.sightlinemg.com\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/federal-logo-white.png\",\n\t                \"contentUrl\": \"https:\\\/\\\/one.sightlinemg.com\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/federal-logo-white.png\",\n\t                \"caption\": \"Federal Times\"\n\t            },\n\t            \"image\": {\n\t                \"@id\": \"https:\\\/\\\/one.sightlinemg.com\\\/federaltimes\\\/#\\\/schema\\\/logo\\\/image\\\/\"\n\t            }\n\t        },\n\t        {\n\t            \"@type\": \"Person\",\n\t            \"@id\": \"https:\\\/\\\/one.sightlinemg.com\\\/federaltimes\\\/#\\\/schema\\\/person\\\/cc76c831bb37a926738c8391fca7a3b1\",\n\t            \"name\": \"migration\",\n\t            \"image\": {\n\t                \"@type\": \"ImageObject\",\n\t                \"inLanguage\": \"en-US\",\n\t                \"@id\": \"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/9e8d47be443ce94ce7fc357677b5f9c70235bb1f59e7267a102a74af58c04f59?s=96&d=mm&r=gcf4cb6ee0ec29e49e7a963234e4340ec\",\n\t                \"url\": \"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/9e8d47be443ce94ce7fc357677b5f9c70235bb1f59e7267a102a74af58c04f59?s=96&d=mm&r=g\",\n\t                \"contentUrl\": \"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/9e8d47be443ce94ce7fc357677b5f9c70235bb1f59e7267a102a74af58c04f59?s=96&d=mm&r=g\",\n\t                \"caption\": \"migration\"\n\t            },\n\t            \"url\": \"https:\\\/\\\/one.sightlinemg.com\\\/federaltimes\\\/author\\\/migration\\\/\"\n\t        }\n\t    ]\n\t}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"When FISMA isn\u2019t enough - Federal Times","description":"Federal agencies, especially civilian organizations, aren't going far enough to secure against cyber-physical threats to the supply chain.","robots":{"index":"noindex","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"When FISMA isn\u2019t enough","og_description":"Federal agencies, especially civilian organizations, aren't going far enough to secure against cyber-physical threats to the supply chain.","og_url":"https:\/\/one.sightlinemg.com\/federaltimes\/opinions\/2018\/08\/16\/when-fisma-isnt-enough\/","og_site_name":"Federal Times","article_published_time":"2018-08-16T01:31:46+00:00","article_modified_time":"2026-08-08T04:49:29+00:00","author":"Robert Metzger","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Robert Metzger","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/one.sightlinemg.com\/federaltimes\/opinions\/2018\/08\/16\/when-fisma-isnt-enough\/#article","isPartOf":{"@id":"https:\/\/one.sightlinemg.com\/federaltimes\/opinions\/2018\/08\/16\/when-fisma-isnt-enough\/"},"author":{"name":"migration","@id":"https:\/\/one.sightlinemg.com\/federaltimes\/#\/schema\/person\/cc76c831bb37a926738c8391fca7a3b1"},"headline":"When FISMA isn\u2019t enough","datePublished":"2018-08-16T01:31:46+00:00","dateModified":"2026-08-08T04:49:29+00:00","mainEntityOfPage":{"@id":"https:\/\/one.sightlinemg.com\/federaltimes\/opinions\/2018\/08\/16\/when-fisma-isnt-enough\/"},"wordCount":699,"commentCount":0,"publisher":{"@id":"https:\/\/one.sightlinemg.com\/federaltimes\/#organization"},"image":{"@id":"https:\/\/one.sightlinemg.com\/federaltimes\/opinions\/2018\/08\/16\/when-fisma-isnt-enough\/#primaryimage"},"thumbnailUrl":"https:\/\/one.sightlinemg.com\/wp-content\/uploads\/2026\/08\/AP17284678637366.jpg.jpg","articleSection":["Daily Brief","Home","IT &amp; Cloud Report","Newsletters","Opinion"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/one.sightlinemg.com\/federaltimes\/opinions\/2018\/08\/16\/when-fisma-isnt-enough\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/one.sightlinemg.com\/federaltimes\/opinions\/2018\/08\/16\/when-fisma-isnt-enough\/","url":"https:\/\/one.sightlinemg.com\/federaltimes\/opinions\/2018\/08\/16\/when-fisma-isnt-enough\/","name":"When FISMA isn\u2019t enough - Federal Times","isPartOf":{"@id":"https:\/\/one.sightlinemg.com\/federaltimes\/#website"},"primaryImageOfPage":{"@id":"https:\/\/one.sightlinemg.com\/federaltimes\/opinions\/2018\/08\/16\/when-fisma-isnt-enough\/#primaryimage"},"image":{"@id":"https:\/\/one.sightlinemg.com\/federaltimes\/opinions\/2018\/08\/16\/when-fisma-isnt-enough\/#primaryimage"},"thumbnailUrl":"https:\/\/one.sightlinemg.com\/wp-content\/uploads\/2026\/08\/AP17284678637366.jpg.jpg","datePublished":"2018-08-16T01:31:46+00:00","dateModified":"2026-08-08T04:49:29+00:00","description":"Federal agencies, especially civilian organizations, aren't going far enough to secure against cyber-physical threats to the supply chain.","breadcrumb":{"@id":"https:\/\/one.sightlinemg.com\/federaltimes\/opinions\/2018\/08\/16\/when-fisma-isnt-enough\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/one.sightlinemg.com\/federaltimes\/opinions\/2018\/08\/16\/when-fisma-isnt-enough\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/one.sightlinemg.com\/federaltimes\/opinions\/2018\/08\/16\/when-fisma-isnt-enough\/#primaryimage","url":"https:\/\/one.sightlinemg.com\/wp-content\/uploads\/2026\/08\/AP17284678637366.jpg.jpg","contentUrl":"https:\/\/one.sightlinemg.com\/wp-content\/uploads\/2026\/08\/AP17284678637366.jpg.jpg"},{"@type":"BreadcrumbList","@id":"https:\/\/one.sightlinemg.com\/federaltimes\/opinions\/2018\/08\/16\/when-fisma-isnt-enough\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/one.sightlinemg.com\/federaltimes\/","ad_zone":"home"},{"@type":"ListItem","position":2,"name":"Opinion","item":"https:\/\/one.sightlinemg.com\/federaltimes\/opinions\/","ad_zone":"opinions"},{"@type":"ListItem","position":3,"name":"When FISMA isn\u2019t enough"}]},{"@type":"WebSite","@id":"https:\/\/one.sightlinemg.com\/federaltimes\/#website","url":"https:\/\/one.sightlinemg.com\/federaltimes\/","name":"Federal Times","description":"Federal Times","publisher":{"@id":"https:\/\/one.sightlinemg.com\/federaltimes\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/one.sightlinemg.com\/federaltimes\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/one.sightlinemg.com\/federaltimes\/#organization","name":"Federal Times","url":"https:\/\/one.sightlinemg.com\/federaltimes\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/one.sightlinemg.com\/federaltimes\/#\/schema\/logo\/image\/","url":"https:\/\/one.sightlinemg.com\/wp-content\/uploads\/2026\/06\/federal-logo-white.png","contentUrl":"https:\/\/one.sightlinemg.com\/wp-content\/uploads\/2026\/06\/federal-logo-white.png","caption":"Federal Times"},"image":{"@id":"https:\/\/one.sightlinemg.com\/federaltimes\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/one.sightlinemg.com\/federaltimes\/#\/schema\/person\/cc76c831bb37a926738c8391fca7a3b1","name":"migration","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/9e8d47be443ce94ce7fc357677b5f9c70235bb1f59e7267a102a74af58c04f59?s=96&d=mm&r=gcf4cb6ee0ec29e49e7a963234e4340ec","url":"https:\/\/secure.gravatar.com\/avatar\/9e8d47be443ce94ce7fc357677b5f9c70235bb1f59e7267a102a74af58c04f59?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/9e8d47be443ce94ce7fc357677b5f9c70235bb1f59e7267a102a74af58c04f59?s=96&d=mm&r=g","caption":"migration"},"url":"https:\/\/one.sightlinemg.com\/federaltimes\/author\/migration\/"}]}},"jetpack_sharing_enabled":true,"distributor_meta":false,"distributor_terms":false,"distributor_media":false,"distributor_original_site_name":"Federal Times","distributor_original_site_url":"https:\/\/one.sightlinemg.com\/federaltimes","push-errors":false,"jetpack_featured_media_url":"https:\/\/one.sightlinemg.com\/wp-content\/uploads\/2026\/08\/AP17284678637366.jpg.jpg","_links":{"self":[{"href":"https:\/\/one.sightlinemg.com\/federaltimes\/wp-json\/wp\/v2\/posts\/20967","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/one.sightlinemg.com\/federaltimes\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/one.sightlinemg.com\/federaltimes\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/one.sightlinemg.com\/federaltimes\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/one.sightlinemg.com\/federaltimes\/wp-json\/wp\/v2\/comments?post=20967"}],"version-history":[{"count":1,"href":"https:\/\/one.sightlinemg.com\/federaltimes\/wp-json\/wp\/v2\/posts\/20967\/revisions"}],"predecessor-version":[{"id":20972,"href":"https:\/\/one.sightlinemg.com\/federaltimes\/wp-json\/wp\/v2\/posts\/20967\/revisions\/20972"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/one.sightlinemg.com\/federaltimes\/wp-json\/wp\/v2\/posts\/31055"}],"wp:attachment":[{"href":"https:\/\/one.sightlinemg.com\/federaltimes\/wp-json\/wp\/v2\/media?parent=20967"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/one.sightlinemg.com\/federaltimes\/wp-json\/wp\/v2\/categories?post=20967"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/one.sightlinemg.com\/federaltimes\/wp-json\/wp\/v2\/tags?post=20967"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/one.sightlinemg.com\/federaltimes\/wp-json\/wp\/v2\/coauthors?post=20967"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}