Module 1 The Federal Security Landscape
What you will be able to do
- Explain what the Federal Information Security Modernization Act requires of agencies and why the framework exists.
- Classify a given source as binding authority or guidance, and explain how guidance becomes mandatory.
- Describe the responsibilities of the ISSO, system owner, authorizing official, assessor, and related roles.
- Trace one obligation from statute to an individual control.
- Describe realistic entry routes and career paths into ISSO work.
Lessons
The lessons, exercise, and quiz are for registered learners. Create a free account or sign in to read them.
- 1. Why the Framework Exists · 35 min Completed
- 2. Binding Authority Versus Guidance · 40 min Completed
- 3. Who Does What: Roles in Federal Security · 40 min Completed
- 4. A Day in the Life of an ISSO · 30 min Completed
- 5. Getting In and Moving Up · 25 min Completed
Practice and quiz
- Practical exercise: The Authority Worksheet
- Module quiz (10 questions, pass mark 80 percent)
Overview
Module 0 ended with a short orientation on how government IT differs. This module expands it into the foundation for everything that follows: the law that makes federal security compulsory, the difference between what binds an agency and what merely advises it, the people involved, and what an Information System Security Officer (ISSO) actually does all day.
There is little technology here. There is a good deal about who is responsible for what, because federal security is, before anything else, a system of responsibility.
Builds on
- Module 0, Lesson 7: the hierarchy of authority and the idea of permission before operation.
- Module 0, Lesson 4: inheritance, which reappears here as the common control provider role.
Lessons
| # | Lesson | Time | Status |
|---|---|---|---|
| 1 | Why the Framework Exists | 35 min | Adapted from existing material |
| 2 | Binding Authority Versus Guidance | 40 min | Adapted |
| 3 | Who Does What: Roles in Federal Security | 40 min | New |
| 4 | A Day in the Life of an ISSO | 30 min | New |
| 5 | Getting In and Moving Up | 25 min | New |
What is binding here, and what is guidance
| Source cited in this module | Kind | Why it has that status |
|---|---|---|
| Federal Information Security Modernization Act (44 U.S.C. 3551 and following) | Binding statute | Passed by Congress |
| OMB Circular A-130 | Binding policy | Issued by the Office of Management and Budget to agencies |
| CISA binding operational directives and emergency directives | Binding on civilian agencies | Issued under authority given by FISMA; do not cover national security systems |
| FIPS 199, FIPS 200 | Binding standards | Compulsory for federal agencies |
| NIST SP 800-37, SP 800-39, SP 800-53 | Guidance, required in practice | Made applicable by FIPS 200 and Circular A-130 |
| NIST SP 800-181 (NICE Framework) | Guidance | Describes work roles; not a requirement |
| DoD 8140 qualification program | Binding within the Department of Defense | Does not bind civilian agencies |
| CNSS instructions (for example, CNSSI 1253) | Binding for national security systems | Outside the scope of this course |
| Certification bodies' requirements | Not federal authority | Matter only where a law, policy, or contract names them |
Module summary
- FISMA makes agency heads responsible for protection that is proportionate to risk, and requires independent evaluation every year.
- Detail flows down a chain: statute, OMB policy, binding standards, NIST guidance, agency policy, system documents.
- NIST Special Publications are guidance made mandatory by FIPS 200 and Circular A-130. Say so precisely.
- The system owner owns the risk day to day, the ISSO describes it, the assessor tests it, and the authorizing official accepts it. The authorization decision cannot be delegated.
- A good ISSO is curious about the real system and lives by four verbs: track, document, report, escalate.
- There are many routes in. Certifications open doors; evidence that you can do the work gets you through them.
What comes next
Module 2 introduces the Risk Management Framework itself and its first real task: deciding how much a system matters. You will adopt TreasuryFlow as your own system and carry it through the rest of the course.
Last reviewed 2026-11-11. Federal requirements, dates, and web addresses change. Before you rely on a date, deadline, or figure, open the source linked in the lesson.