on whether to authorize operation of those systems. The information and supporting evidence needed for security accreditation is developed during a detailed security review of an information system, typically referred to as security certification. Security certification is a comprehensive assessment of the management, operational, and technical security controls in an information system, made in support of security accreditation, to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the system. The results of a security certification are used to reassess the risks and update the system security plan, thus providing the factual basis for an authorizing official to render a security accreditation decision. Continuous monitoring All accredited systems are required to monitor a selected set of security controls and the system documentation is updated to reflect changes and modifications to the system. Large changes to the security profile of the system should trigger an updated risk assessment, and controls that are significantly modified may need to be re-certified. Continuous monitoring activities include configuration management and control of information system components, security impact analyses of changes to the system, ongoing assessment of security controls, and status reporting. The organization establishes the selection criteria and subsequently selects a subset of the security controls employed within the information system for assessment. The organization also establishes the schedule for control monitoring to ensure adequate coverage is achieved. Critique Security experts Bruce Brody, a former federal chief information security officer, and Alan Paller, director of research for the SANS Institute, have described FISMA as "a well-intentioned but fundamentally flawed tool", arguing that the compliance and reporting methodology mandated by FISMA measures security planning rather than measuring information security. Past GAO chief technology officer Keith Rhodes said that FISMA can and has helped government system security but that implementation is everything, and if security people view FISMA as just a checklist, nothing is going to get done. See also Attack (computing) Committee on National Security Systems Computer security Cybersecurity Cyberwarfare Department of Defense Information Assurance Certification and Accreditation Process Federal Desktop Core Configuration – security standards for Windows workstations Information assurance Information security Information security management system IT risk OMB Circular A-130 Security Content Automation Protocol – automated testing for security compliance Threat (computer) Vulnerability (computing) References External links NIST Special Publications Library NIST FISMA Implementation Project Home Page