Which of the following best describes what FISMA does?

• A. Regulates healthcare data
• B. Defines how federal government data, operations, and assets are handled.
• C. Sets encryption standards
• D. Controls software licensing

Answer: (B)

FISMA focuses on governance and protection of federal information and systems. It requires agencies to create and implement an information security program, perform risk assessments, select and apply security controls guided by NIST standards, and continuously monitor and report on security posture. This framework ensures consistent protection of data, operations, and assets across the federal government. It isn’t about healthcare data (that’s HIPAA), nor does it single out encryption standards or software licensing—its purpose is to manage risk and security across federal information systems.