Under FISMA, which items are reported to the OMB annually?

• A. Adequacy of security program
• B. Adequacy of plans and reports relating to annual budgets
• C. Significant deficiency
• D. All of the above

Answer: (D)

FISMA requires annual reporting to the Office of Management and Budget on an agency’s information security posture and investments. In these reports, the agency must evaluate and disclose the adequacy of its information security program, the adequacy of plans and reports related to information security budgeting, and any significant deficiencies identified in the security program along with remediation status. Since all of these elements are part of the standard annual security reporting package to OMB, every item listed is reported.