← Global Privacy Laws Research Library
Public Law 113-283 (18 December 2014); 44 U.S.C. §§ 3551-3558
Federal Information Security Modernization Act of 2014 (FISMA)
Prepared by Shubhank Suman · Last reviewed
CURRENT / IN FORCE
- Legal character
- Statute
- Region
- North America
What it covers
FISMA 2014 replaces 44 U.S.C. Chapter 35, Subchapter II. OMB oversees federal information security policy; DHS administers its implementation for civilian agencies, including binding operational directives and a federal information security incident center. Each agency head must run an agency-wide security programme based on risk, report major incidents to Congress, and have an annual independent evaluation by its Inspector General.
Why it matters
It is the core law on information security in US federal agencies and drives NIST standards use and federal contractor security requirements.
Refer to it when
Use it for security duties of US federal agencies, contractors operating federal systems, or federal incident reporting.
AI, privacy and cybersecurity relevance
- AI: Low
- Privacy: Moderate
- Cyber: Very High
AI
LOW RELEVANCE
No AI-specific provisions.
Privacy
MODERATE RELEVANCE
Requires breach reporting guidance covering personal information.
Cybersecurity
VERY HIGH RELEVANCE
Federal information security framework.
Applicability
US federal agencies and those operating information systems on their behalf.
Current validity
CURRENT. Enacted 18 December 2014. Read the official PDF on this page for the operative text.
Read first
Section 3552 → 3553 → 3554 → 3555.
Provisions / sections covered
Section 3552 – Definitions
Information security, incident, major incident terms.
Section 3553 – Authority of OMB and DHS
Policy oversight and binding operational directives.
Section 3554 – Agency responsibilities
Agency security programmes and incident reporting.
Section 3555 – Annual independent evaluation
Inspector General evaluations.
Section 3556 – Federal information security incident center
Central incident centre functions.
Subject-matter tags
- Data breach
- Government data
- AI cybersecurity
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Related instruments in this library
- HIPAA: United StatesLaw · Current (amended)Same jurisdiction; assess applicability separately.
- NIST Artificial Intelligence Risk Management Framework (AI RMF 1.0)Framework · Voluntary / non-bindingSame jurisdiction; assess applicability separately.
- Stored Communications Act – 18 U.S.C. Chapter 121Law · CurrentSame jurisdiction; assess applicability separately.
- Video Privacy Protection Act – 18 U.S.C. § 2710Law · CurrentSame jurisdiction; assess applicability separately.
- Cybersecurity Information Sharing Act of 2015Law · CurrentSame jurisdiction; assess applicability separately.
- Right to Financial Privacy Act of 1978Law · Current (amended)Same jurisdiction; assess applicability separately.
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.