FISMA compliance is not a static checkbox. Each annual cycle brings updated control requirements, revised baselines, and new guidance from NIST and OMB that affect how your system authorization is maintained.

The key changes in NIST SP 800-53 Rev 5

The most significant shift in the current cycle is the consolidation of privacy controls into the main control catalog and the addition of supply chain risk management as a new control family. Both changes require agencies to revisit their system security plans and assess whether existing controls still meet the updated baselines.

This is not optional housekeeping. OMB Circular A-130 requires that agencies maintain continuous compliance, which means your ATO documentation must reflect current control mappings before the next assessment window.

How authorization boundaries have shifted

Cloud-hosted systems and shared service environments introduced ambiguity around where one agency's authorization boundary ends and another's begins. The current guidance tightens that definition, requiring explicit documentation of inherited controls from FedRAMP-authorized services.

If your agency relies on any cloud infrastructure, this affects your System Security Plan directly. Review your inheritance table and confirm the FedRAMP authorization status of every shared component before your next review.

What happens at your next assessment

Assessors will look for documented evidence that your agency reviewed, acknowledged, and addressed each change in the current cycle. A gap in your POA&M, an outdated control mapping, or an undocumented inherited control will generate a finding.

The goal of this course is to make sure none of those gaps exist before your assessor arrives. Complete each lesson, then run the scenario walkthrough in Unit 4. It mirrors what assessors actually check.