FISMA applies to which type of organization?

• A. E-commerce firms
• B. Medical firms
• C. Government organizations
• D. Companies that accept credit card payments

Answer: (C)

FISMA stands for the Federal Information Security Management Act, a U.S. federal law focused on protecting information and information systems used by the government. Its primary audience is government organizations—the federal agencies and departments that run the government. The legislation requires these agencies to implement a formal framework of risk management, apply appropriate security controls, perform regular risk assessments, and obtain authorization to operate for their information systems, with ongoing monitoring to maintain security.

Contractors and service providers that process federal information are also subject to FISMA when their work involves government data, but the law’s core aim is to govern government organizations and their information systems. Private-sector sectors like e-commerce, healthcare, or payment processing are governed by other regulations and standards (for example, PCI DSS for card payments or HIPAA for healthcare), rather than FISMA.