Foglight Experience Monitor 5.8.1 - Security and Compliance Field Guide

FISMA overview

The Federal Information Security Management Act (FISMA) was passed by the U.S. Congress and signed by the U.S. President, and is part of the Electronic Government Act of 2002. It requires “each federal agency to develop, document, and implement an agency-wide program to provide information security for the information and information system that support the operations an assets of the agency, including those provided or managed by another agency, contractor, or other source”.

NOTE: For additional details about FISMA, see http://csrc.nist.gov/sec-cert/.

A major component of FISMA implementation is the publication by the National Institute of Standards and Technology (NIST), entitled Recommended Security Controls for Federal Information Systems, listed as NIST Special Publication 800-53 (for additional information about this publication, see http://csrc.nist.gov/publications/PubsSPs.html). This document lists 17 general security categories against which an information security control program should be evaluated, so as to measure its level of compliance with an agency’s obligations under FISMA. Quest Software Inc. wishes to provide its customers with enough information regarding security aspects of Foglight Experience Monitor to enable them to perform their own evaluation of how FxM fits in with their desired FISMA compliance levels. For more information, see NIST 800-53 categories.

NIST 800-53 categories

This section presents the 17 categories listed in the NIST Special Publication 800-53 and describes how Foglight Experience Monitor addresses those that apply.

The secure employment of Foglight Experience Monitor forms only one part of an information security program. A statement in this appendix that a particular security category is “applicable” to Foglight Experience Monitor means only that FxM contains security features that are or may be relevant to some or all aspects of the security category in question. It does not necessarily mean that Foglight Experience Monitor fully meets all of the requirements described in that security category, or that the use of Foglight Experience Monitor by itself guarantees compliance with any particular information security standards or control programs. The selection, specification, and implementation of security controls in accordance with a customer-specific security program is ultimately dependent upon the manner in which the customer deploys, operates, and maintains all of its network and physical infrastructure, including the Foglight Experience Monitor.

The following table presents the NIST 800-53 categories and describes how Foglight Experience Monitor addresses those that apply.

NOTE: Under the NIST Special Publication 800-53, the 17 categories listed in this table define general security control “families” (for example, AC), and each family in turn contains several subcategories (for example, AC-1, AC-2, AC-3, etc.) that further detail related aspects of information security and assurance. For additional information, see Appendix F of NIST Special Publication 800-53.