A Brief Note On Federal Information Processing Standards

A compliance program is a process or system that finds all consumer laws and guarantees that have breached (refer to part A).

It is often recommended for (HCO)’s to have a corporate compliance plan to be more efficient, reduce errors, and not have small errors turn into large errors. As (OIG) it’s a necessary and fundamental need to incorporate a corporate compliance plan to have for staff and management to stay organized and lessen the chance of fraud, waste, and abuse in the company. Stated by, (Cleverly, Song, & Cleverly, 2011), it is effective only if it includes management support, effective communication, continuous monitoring, and individual accountability. All these aspects are a continual monitoring requirement as long the corporate compliance is in place for the duration.

information might be granted. In order for security policies to be effective, they must be

Federal supervision of electronics has been prevalent since the 60's, and has become increasingly intrusive with laws such as the ECPA and USA PATRIOT Acts. These laws authorized the legal surveillance of foreigners, and Americans abroad. However, with the Communications Assistance for Law Enforcement Act requiring communication companies to provide backdoors for government use, agencies such as the National Security Agency have abused their powers in secrecy. More recently, Edward J. Snowden released NSA files that revealed the agency to illicitly engage in unwarranted surveillance of Americans both abroad and at home. (Introduction to Domestic Surveillance: Current Controversies)

Compliance programs are more focused on risk management. The duties include informing staff about the laws and guidelines regulating the business and monitoring adherence to these policies (Nelson, 2012). (Nelson, 2012) By monitoring compliant behavior the programs reduce the episodes of litigation, negative press, loss of support, and confidence from the public(Nelson, 2012).

Another step involves security checks upon implementation and describes agency-level threat to the business scenario or the mission. It similarly entails sanctioning the information system for processing and lastly constant monitoring of the security controls. FISMA and NIST's standards are aimed at offering the ways for agencies to achieve their identified missions with safety commensurate with the threat (United States Department of Agriculture, 2015). Together with guidelines from the Office of Management and Budget (OMB), FISMA and NIST create a framework for advancing and growing an information security scheme (SecureIT, 2008). Such framework includes control descriptions and evaluation, program development, and system certification and accreditation. The final objective involves conducting daily functioning of the agency and achieving the agency's articulated objectives with sufficient security commensurate with risk.

So, a bill that almost 40 years ago which clearly stipulated that it could only be used for monitoring foreign agents has been made available to non-intelligence agencies that were not the subjects of the original bill to conduct more intrusive surveillance. Specifically, with the PATRIOT Act, law enforcement could now use the FISA Act as a precursor to obtain private information from “banks, businesses, credit companies, Internet providers, and others about U.S. citizens without a showing of probable cause” (Baker 15). This obviously were not part of the original FISA Act, because the original FISA Act pertained to foreign nationals and spies in the United States, not American citizens. More importantly however this amendment to the FISA Act that gives the government the opportunity to obtain private information without probable cause is in strong violation of Fourth Amendment which stipulates that “the right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause” (US. Const. amend. IV), because now the government doesn’t need probable cause anymore to conduct surveillance or gather private information.

The OIG 2011 FISAM Assessment indicates that “FISMA Section 3544 requires establishing policies and procedures to ensure information security is addressed throughout the life cycle of each agency information system” (VA Office of Inspector General, 2012, p. 9). Based on the lack of consistency in use of SDLC and change control, major security risks may go unnoticed.

Many people are beginning to realize how serious the ISIS and their online schemes are. “The United States of America is under attack,” warned Rep. Elijah Cummings during a House Oversight and Government Affairs Committee hearing in June of 2015. (Law Street) Katherine Archueta is the director of OPM. She faced a lot criticism at the hearing for not updating the databases, because she was already aware of the security issues. An audit was carried out on OPM on November of 2014, not long before the breach. It revealed that several databases still did not meet federal security standards. It was known that many of the databases

It would be hard to image such an act which compromises privacy rights as much as the USA Patriot Act does were it not for the incredible threat another terrorist attack had on the United States. The search warrants spawned from this Act permitted the government to search your home or business, all without your consent or knowledge of the search. In some cases individuals subjected to them are not told about it until months after the search was performed. This Act also broadened the authority the FBI had to issue National Security Letters requesting information on American citizens. Using a much lower standard than under previous law, National Security Letters can compel third parties, such as banks and internet providers to secretly reveal your personal information at their request. Judicial approval is not required, the FBI needs only to certify that the information they requested is "relevant" to a investigation on terrorism. The USA Patriot Act also amended 18 USC. § 2339, to include "expert advice or assistance" as a prohibited form of "support" to terrorists. This is important because countries found to be advising terrorists, possibly Saudi Arabia, can potentially face charges on that behavior more easily than before when 18 USC. § 2339, only criminalizes giving "material support" to

To ensure that all concerns / complaints are dealt with in accordance with the procedures.

Federal Information Security Management Act (FISMA) is a U.S. federal law for Information Security, enacted in December 2002, with the intent to protect government information against any natural or man-made threats. It is also referred to as Title III of the E-Government Act. This law would want each and every federal agency to document, develop and implement an agency-wide program to provide Information Security for the Information Systems that support the operations and assets of the agency. This act requires chief Information officers and the head of each agency to conduct annual reviews of Information security programs and submit the results to OMB. The purpose of conducting reviews

The Main Purpose of Security Management and Security Measures must be Commensurate with the Threat

not only to ensure that the system does what it is expected to, but also to identify

It ensures that all policies and procedures are communicated to all employees accurately and in a consistent manner.