What is OpenFISMA?

The OpenFISMA project is an open source application designed to reduce the complexity and automate the regulatory requirements of the Federal Information Security Management Act (FISMA) and the National Institute of Standards and Technology (NIST) Risk Management Framework (RMF). OpenFISMA is built on a modern, standardized platform called Zend Framework, which is an open source, object-oriented web application framework with a flexible architecture.

What Makes OpenFISMA Unique?

The OpenFISMA project is unique in several ways.

Open Source

OpenFISMA is the largest open source security project for the U.S. federal government. See the open source section for an explanation of the advantages of open source.

Highly customizable

OpenFISMA is highly customizable through our web-based administration interface. The branding can be changed. The workflow can be changed. The roles and privileges can be changed. New reports can be added to the system without writing a single line of code.

Easy to deploy

OpenFISMA comes with built-in security controls that allow you to easily C&A your OpenFISMA implementation with ease. OpenFISMA also provides configurable security policies so that your implementation will fall in-line with your agency’s specific security policies as well.


Track security weaknesses to closure

OpenFISMA provides a proven business process for tracking the remediation of security weaknesses. This business process enforces quality controls and segregation of duty, pulling together individuals from different areas of the organization to plan, execute, and review all remediation actions.

Role-based access control

Access control is based on roles; each role has fine-grained access to certain privileges on each information system that is being tracked. The roles are completely customizable.

Active Directory/OpenLDAP Authentication

Authentication in OpenFISMA can be handled by any LDAP-compatible service, such as Microsoft Active Directory (AD) or OpenLDAP, in order to provide single sign-on convenience for your agency’s users.

Scan Injection

If you run automated scans as part of your C&A process or as part of a continuous monitoring program, you can upload your scan results in XML format directly into OpenFISMA. OpenFISMA uses the information in scans to create new findings, assess risk exposure, and even update your asset inventory. The scan injection provides some smarts, too. OpenFISMA matches new scan results against past scan results. Based on a simple set of rules, it decides whether to supress duplicate findings or to flag multiple, similar findings for human review. This reduces the overhead of redundant findings and can also help your organization identify systemic weaknesses that could be addressed more efficiently at the enterprise level.

E-mail Notifications

OpenFISMA sends notifications directly to users’ inboxes when action is needed from them. This automated notification system relieves security managers of the burden of manually monitoring the workflow. The notification system also reduces turn-around time by alerting users quickly when their action is needed.

Rich Text Editing

Data about findings is entered using a rich text editor that allows for formatting (bold, italics, underline, and outline formats) as well as spell checking.

Plug-in Reports

Reporting is one of the most critical requirements for any process management tool. OpenFISMA provides the ability to “plug in” a report without writing any code. These reports are created by writing SQL and updating a configuration file. OpenFISMA then creates the interface and data export features on-the-fly. The plug-in architecture drastically reduces the cost and time involved in creating custom reports.

NIST SP 800-53 Rev. 3

OpenFISMA contains many of the NIST SP 800-53 security controls required for a FIPS-199 “high” impact information system. This helps you get your OpenFISMA instance authorized to operate quickly. The built-in controls include system use notification, rules of behavior, electronic privacy policy (p3p), and many, many more. OpenFISMA also contains a catalog of all NIST SP 800-53 Rev. 3 controls built-in. Findings in OpenFISMA can be matched against these security controls to provide supplemental information for remediation and planning. The catalog includes descriptions of the controls, scoping, and supplemental guidance.

Benefits of Open Source

OpenFISMA is open source software (OSS) licensed under the GNU Public License v3 (GPL3). This license allows anybody, anywhere to download and view the source code, and even modify it, repackage it, and redistribute it. The main requirement of this license is that any modifications that are made must be shared back to the community. In this way, the software is guaranteed to remain free and open forever. This license bears a number of advantages for government agencies:

Distributed Costs

Because changes are shared across the OpenFISMA community, each agency that implements OpenFISMA will benefit from the investments that other agencies make into the program. For example, if Agency A invests in building a new feature X, and Agency B invests in building a new feature Y, then Agency A and Agency B will reap the benefits of both feature X and feature Y, while only bearing part of the costs. When an agency develops software in-house, that software becomes closely tied to that agency’s own requirements. In the long run, tax dollars get spent re-implementing the same functionality at many different agencies. With OpenFISMA, however, tax dollars can be spent once and the benefits are shared government-wide. The House Armed Services Committee agrees; they recently touted the benefits of OSS in a report on the 2009 national defense budget.

The committee is concerned by the rising costs and decreasing security associated with software development for information technology systems. These rising costs are linked to the increasing complexity of software, which has also resulted in increasing numbers of system vulnerabilities that might be exploited by malicious hackers and potential adversaries… The committee encourages the department to rely more broadly on OSS [ Open Source Software] and establish it as a standard for intra-department software development. http://www.dtic.mil/congressional_budget/pdfs/FY2009_pdfs/HASC_110-652.pdf


Unlike typical COTS or GOTS software, Open Source Software is visible to the entire world. If you are concerned about the security of the application, you have full access to the raw source code in order to inspect how security is handled. With proprietary products, the source code is not available, and the application has to be tested as a black box.


Maintainability is also improved because of our transparency. A programmer who finds a bug in OpenFISMA can perform root cause analysis on the source code and produce a patch file for the community. Bugs in proprietary software are often costly and time-consuming to resolve.

Vendor Lock-in

Since OpenFISMA has open source code and extensive documentation, there is no vendor lock-in effect. With proprietary systems, agencies get locked into a vendor’s platform because their data is stored in a proprietary format and the cost of switching over to a new platform is prohibitively high.