Enterprise FISMA Compliance & Security Authorization

Led the Risk Management Framework (RMF) assessment and security authorization for six Moderate-Impact VA medical applications. The project focused on protecting sensitive Veteran PHI and PII while ensuring compliance with FISMA, HIPAA, and NIST SP 800-53 Rev. 5 standards. Successfully supported the systems through assessment and Authority to Operate (ATO).

Risk Management Framework (RMF)
FISMA & HIPAA Compliance
Security Authorization (ATO)
NIST SP 800-53 Rev.5

Vulnerability Assessment
PII & PHI Protection
Audit & Compliance Reporting
Security Documentation

This enterprise cybersecurity initiative standardized security controls across six interconnected VA medical applications handling sensitive healthcare information. Authorization boundaries, security categorization, and compliance requirements were established using federal cybersecurity frameworks.

Strategy

Defined authorization boundaries, categorized information systems, documented data flows, and selected security controls aligned with federal compliance requirements.

Design

Implemented security controls, encryption standards, audit logging, and vulnerability management processes while maintaining compliance with VA security policies.

Features

Six Moderate Systems
AES-256 Encryption
TLS 1.3 Security
Splunk SIEM Integration

Security assessments included vulnerability scanning, remediation planning, documentation, and compliance validation. All required artifacts were prepared to support the organization’s security authorization process.

Understanding Brief Research Design Process

Conducted detailed security assessments, analyzed compliance requirements, and evaluated system risks against NIST and HIPAA standards.

Applied RMF methodology, implemented security controls, documented compliance evidence, and supported successful authorization activities.

The project strengthened the security posture of multiple enterprise healthcare systems by implementing standardized cybersecurity controls, improving audit readiness, and protecting sensitive Veteran information while supporting successful authorization outcomes.