← Back to Blog Compliance

FISMA Cryptographic Requirements 2026 Edition

11 min read

The Federal Information Security Modernization Act of 2014 (FISMA, Public Law 113-283) updated the original Federal Information Security Management Act of 2002 and made the Office of Management and Budget (OMB) and the Department of Homeland Security responsible for federal cybersecurity policy and oversight, with NIST providing the technical standards. FISMA does not mention specific algorithms in its statutory text, but it requires federal information systems to be protected by adequate security commensurate with risk, and it delegates the technical specification to NIST. That delegation is the chain through which cryptographic standards reach federal civilian and contractor systems.

This article walks through the FISMA cryptographic compliance chain, the FIPS standards that flow from it, the OMB memorandums that drive post quantum migration timelines (most importantly M-23-02), and what this means for federal agencies and their contractors in 2026.

The Statute and Its Delegations

FISMA 2014 (which is itself an update of FISMA 2002) requires:

Each federal agency to develop, document, and implement an agency wide information security program
Periodic risk assessments
Policies and procedures based on risk assessments
Subordinate plans for providing adequate security
Security awareness training
Annual independent evaluation

The technical content of "adequate security" is specified by NIST through FIPS publications and Special Publications. FISMA explicitly directs federal agencies to comply with FIPS standards for cryptography, identification, and other security functions, except for National Security Systems (which follow CNSS guidance).

FIPS Standards That Apply

The FIPS standards most relevant to cryptography in FISMA scope include:

FIPS 199, Standards for Security Categorization of Federal Information and Information Systems (the FIPS 199 categorization is Low, Moderate, or High impact)
FIPS 200, Minimum Security Requirements for Federal Information and Information Systems
FIPS 140-3, Security Requirements for Cryptographic Modules
FIPS 197, Advanced Encryption Standard (AES)
FIPS 202, SHA-3 Standard
FIPS 180-4, Secure Hash Standard
FIPS 186-5, Digital Signature Standard
FIPS 203, Module Lattice Based Key Encapsulation Mechanism Standard (ML-KEM)
FIPS 204, Module Lattice Based Digital Signature Standard (ML-DSA)
FIPS 205, Stateless Hash Based Digital Signature Standard (SLH-DSA)

FIPS 203, 204, and 205 were finalized on 13 August 2024 and are the foundation of the federal post quantum migration. These three FIPS publications give federal agencies and their contractors the binding standards under which to implement PQC.

NIST SP 800-53 as the Control Catalog

NIST SP 800-53 Revision 5 is the catalog of security and privacy controls that federal information systems implement to satisfy FISMA. The cryptographic controls in SP 800-53 (including SC-13 Cryptographic Protection, SC-12 Cryptographic Key Establishment and Management, IA-7 Cryptographic Module Authentication, and others) are the operational hooks through which FIPS standards reach actual systems.

Each control has a description, supplemental guidance, and assignment / selection statements that the implementing agency completes. For SC-13, the assignment typically lists the cryptographic uses in the system (confidentiality protection, integrity protection, authentication, etc.) and the algorithm choices for each.

FIPS 199 Impact Levels

FIPS 199 categorizes information systems as Low, Moderate, or High impact based on the potential impact of a security event on the confidentiality, integrity, or availability of the information. The categorization determines which control baseline from SP 800-53B applies.

For cryptographic controls:

Low baseline: minimum cryptographic protection, often including TLS for transit and at rest encryption for some data
Moderate baseline: stronger cryptographic protection, FIPS validated modules typically required
High baseline: most stringent, often with hardware security modules and additional controls

Most federal civilian systems are categorized Moderate. Defense and intelligence systems are typically High or are categorized as National Security Systems and follow CNSS rather than FISMA.

OMB Memorandum M-23-02

OMB Memorandum M-23-02, Migrating to Post Quantum Cryptography, was issued on 18 November 2022. M-23-02 directs federal civilian agencies to:

Inventory their cryptographic systems by 4 May 2023, with annual updates
Submit migration plans
Prioritize systems based on risk
Coordinate with CISA and NIST on the migration

The inventory requirement is significant. Each federal civilian agency had to identify all systems that use cryptography subject to quantum threats (RSA, ECDSA, ECDH, finite field DH) and document the inventory. The inventory becomes the planning baseline for migration.

M-23-02 designates the Office of the National Cyber Director (ONCD) as the policy lead and CISA as the operational lead, with NIST providing technical standards. The memorandum sets the federal civilian timeline broadly aligned with the NSA CNSA 2.0 timeline for National Security Systems.

The 2035 Endpoint

Although M-23-02 does not specify a single endpoint year, the practical alignment is with CNSA 2.0's 2035 endpoint. Federal civilian agencies are expected to complete migration of high priority systems sooner, with full migration of all systems by 2035. We discuss this in our 2035 deadline article.

CISA, ONCD, and NIST publish updates and guidance that refine the migration expectations. Agencies submit FISMA reports annually and CIOs report progress through the agency's Inspector General.

National Security Memorandum 10

National Security Memorandum 10 (NSM-10), Promoting United States Leadership in Quantum Computing While Mitigating Risks to Vulnerable Cryptographic Systems, was issued on 4 May 2022. NSM-10 directs federal agencies to take specific actions on quantum threats, including:

Maintaining inventories of cryptographic systems
Migrating to PQC standards
Engaging with international partners

NSM-10 applies broadly across federal agencies, complementing M-23-02 for civilian agencies and operating alongside CNSA 2.0 for NSS.

CISA Role

CISA (Cybersecurity and Infrastructure Security Agency) is the operational lead for federal civilian cybersecurity. CISA publishes:

Binding Operational Directives (BODs) that compel specific actions
Cybersecurity Performance Goals (CPGs) that recommend baseline practices
Advisories on specific threats
Implementation guidance for PQC migration

CISA's PQC guidance has emphasized the cryptographic inventory, vendor engagement, and migration prioritization. The CISA Quantum Readiness publications provide structured advice for agencies and critical infrastructure operators.

Cryptographic Inventory Methodology

The cryptographic inventory required by M-23-02 typically captures:

System name and FISMA categorization
Cryptographic use (confidentiality, integrity, authentication, etc.)
Algorithms and parameter sizes (RSA-2048, ECDH P-256, AES-256, etc.)
Cryptographic modules in use (commercial product, open source library, etc.)
Migration priority
Estimated migration timeline
Vendor contact and roadmap

Some agencies have built dedicated tools for the inventory. CISA has provided spreadsheet templates for smaller agencies. Larger agencies have integrated inventory management with their existing FISMA tooling.

Migration Prioritization

Migration prioritization considers:

Sensitivity of the data (long lived classified or controlled information first)
Exposure to harvest now decrypt later attacks (data crossing untrusted networks first)
Operational impact of migration
Vendor readiness
Dependencies on legacy systems

We covered the harvest now decrypt later threat model in our dedicated article. Federal civilian systems handling long term sensitive data, especially those whose traffic crosses the open internet, are typical priority candidates.

FIPS Validation Pipeline

FIPS validation under the Cryptographic Module Validation Program (CMVP) is a prerequisite for many FISMA cryptographic implementations. The CMVP queue is significant, often eighteen months from submission to certificate.

For PQC migration, federal agencies are dependent on cryptographic module vendors getting their PQC enabled modules through the CMVP queue. NIST publishes CMVP queue status and certificate listings. We covered CMVP in our CMVP and FIPS 140-3 article.

Agency Plans of Action and Milestones

Agencies document gaps and remediation through Plans of Action and Milestones (POAMs). For PQC, the POAM might capture:

Identified system using legacy cryptography
Migration plan (vendor selection, deployment, decommissioning)
Milestone dates
Resource allocation
Risk acceptance during transition

POAMs are reviewed during continuous monitoring and during annual FISMA evaluations.

Annual FISMA Reporting

FISMA requires annual independent evaluation of each agency's information security program. The evaluation, conducted by the agency's Inspector General or by an independent external auditor, assesses:

Risk management
Configuration management
Identity and access management
Data protection and privacy
Security training
Information security continuous monitoring
Incident response
Contingency planning

Cryptographic controls appear across multiple of these areas. The FISMA report rolls up findings to OMB, which publishes annual federal cybersecurity reports.

Federal Civilian and Contractor Flow Down

Federal contractors handling federal information must comply with FISMA and the applicable controls flow through Federal Acquisition Regulation (FAR) clauses. The most consequential clauses include:

FAR 52.204-21 (basic safeguarding)
DFARS 252.204-7012 (covered defense information for DoD)
FAR 52.204-25 (prohibition on certain telecommunications equipment)
Contract specific cybersecurity clauses

Contractors handling Controlled Unclassified Information are also subject to NIST SP 800-171 and CMMC for DoD, which we cover in our CMMC article.

Federal Public Key Infrastructure

The Federal Public Key Infrastructure (FPKI) is the certificate ecosystem that authenticates federal employees and systems. FPKI uses PKI certificates that today are issued with RSA or ECDSA. PQC migration of FPKI is a significant undertaking because of the scale (hundreds of thousands of certificates) and the dependencies (PIV cards, smart card readers, applications that validate certificates).

NIST has been working with the FPKI Policy Authority on a PQC migration roadmap. Hybrid certificates that include both classical and PQC algorithms are one approach being piloted.

What This Means for Federal Agency CIOs

A federal agency CIO in 2026 should:

Verify the cryptographic inventory is current and complete.
Submit migration plans on the schedule specified by M-23-02.
Coordinate with CISA on prioritization.
Engage cryptographic module vendors on their CMVP roadmaps.
Track agency POAM status for cryptographic gaps.
Brief the IG and Audit functions on PQC posture during annual FISMA evaluations.

What This Means for Federal Contractors

A federal contractor in 2026 should:

Verify FAR / DFARS cryptographic clauses are reflected in delivered systems.
Maintain FIPS validated cryptographic module currency.
Engage primes about flow down expectations for PQC.
Plan PQC migration aligned with agency timelines.
Document cryptographic posture in deliverable SSPs and assessment artifacts.

Authorization to Operate Lifecycle

Each federal information system holds an Authorization to Operate (ATO) issued by an authorizing official within the agency. ATOs are typically valid for three years, with continuous monitoring during that period. Cryptographic posture is reviewed at ATO issuance and through continuous monitoring, with material changes triggering re authorization.

For PQC migration, the ATO renewal cycle is the natural point at which cryptographic upgrades land. A system whose ATO renews in 2027 will face evaluation against current cryptographic expectations, including any binding PQC requirements that have emerged. Agencies plan migrations to align with ATO cycles to minimize duplicated assessment effort.

High Value Asset Inventory

CISA maintains the High Value Asset (HVA) inventory of federal systems whose loss or compromise would have an outsized impact on national security or public safety. HVAs receive prioritized cybersecurity attention and are typically among the first systems to migrate to PQC. Agencies report HVA status and security posture to CISA on a continuous basis.

FAQ

Q: Does FISMA require AES-256? A: FISMA requires FIPS validated cryptography meeting applicable standards. AES-128 and AES-256 are both FIPS validated. Specific algorithm choices follow agency policy and the FIPS 199 categorization.

Q: When does FISMA require PQC? A: FISMA requires PQC through M-23-02 inventory and migration planning. Specific deadlines for individual systems depend on agency planning and prioritization, with 2035 as the broad endpoint.

Q: Does FISMA apply to NSS? A: National Security Systems are governed by CNSS rather than FISMA, though many requirements parallel each other. CNSA 2.0 governs cryptography for NSS.

Q: What is OMB M-23-02 in one sentence? A: It is the November 2022 OMB memorandum directing federal civilian agencies to inventory cryptographic systems, plan PQC migration, and report progress.

Q: Who reviews agency FISMA cryptographic compliance? A: The agency's Inspector General or an independent external auditor conducts the annual evaluation, with reporting to OMB and Congress.

Sources

Federal Information Security Modernization Act of 2014, Public Law 113-283. https://www.govinfo.gov/app/details/PLAW-113publ283
OMB Memorandum M-23-02, Migrating to Post Quantum Cryptography (November 2022). https://www.whitehouse.gov/wp-content/uploads/2022/11/M-23-02-M-Memo-on-Migrating-to-Post-Quantum-Cryptography.pdf
National Security Memorandum 10 (May 2022). https://www.whitehouse.gov/briefing-room/statements-releases/2022/05/04/national-security-memorandum-on-promoting-united-states-leadership-in-quantum-computing-while-mitigating-risks-to-vulnerable-cryptographic-systems/
NIST SP 800-53 Revision 5 and Revision 5.1.1. https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final
NIST FIPS 203, 204, 205 (August 2024). https://csrc.nist.gov/projects/post-quantum-cryptography
CISA Quantum Readiness publications. https://www.cisa.gov/quantum

Protect Your Data Before Q-Day Arrives

QNSQY's NIST-standardized post-quantum encryption protects files against both current and quantum-era threats.

Try QNSQY