Which organization provides guidelines for implementing security standards and guidelines for federal agencies (as referenced by FISMA)?

• A. ISO
• B. OWASP
• C. NIST
• D. IEEE

Answer: (C)

FISMA relies on guidelines and security controls published by a U.S. government body that specializes in standards and cybersecurity. That organization is NIST—the National Institute of Standards and Technology. NIST produces the SP 800-series and other frameworks that federal agencies use to implement security controls and achieve compliance with FISMA.

ISO provides international standards, not the U.S. federal-specific guidance referenced by FISMA. OWASP focuses on web application security practices, and IEEE covers a broad range of engineering standards, not the mandated federal security guidance for FISMA.