2.  Background  Components and Guidelines  Frequently Asked Questions OVERVIEW

3.  Corrective Action Plans (CAPs) are a requirement of FISMA.  CAPs make FISMA an ongoing process. Ensures risks are corrected, not just identified.  They cover a period of time, not a point in time. BACKGROUND

4.  Include all risks where action has not been fully implemented.  Describe the action taken so far.  Describe additional action to be taken.  State when additional action will be implemented. COMPONENTS

5. GUIDELINES  There is no required format.  Plan must be UPDATED every six months.  Last year’s risks are not required to be included in the new action plan.

8. What are the consequences if our department does not complete these CAPs? QUESTION #1

9. The same as not submitting a FISMA Report. Department will be posted to the non- compliers list Finance representative may contact the department for follow-up Program Budget Managers may be notified BCPs may be declined ANSWER #1

10. Where should I send my CAPs? QUESTION #2

11. CAPs are required to be sent to FISMAhotline@dof.ca.gov FISMAhotline@dof.ca.gov ANSWER #2

12. I’m unclear when the first CAP is supposed to be submitted. QUESTION #3

13. 12/31/11 FISMA Report Dated 1/30/12 CAP due ONLY IF it was not included with the report 2 nd CAP Due 6/30/12 6 months from REPORT DATE 3 rd CAP Due 12/31/12 Dec J a n Jun Dec 30 days from REPORT DATE ANSWER #3

14. Is the CAP required to be posted to the Transparency website? QUESTION #4

15. No. Only the FISMA Report is required to be posted. ANSWER #4

16. If there are risks not fully mitigated/corrected by the end of the FISMA period, do they have to be included in the next FISMA report? QUESTION #5

17. Only if management still considers them a risk. Prior risks should be considered in the subsequent risk assessment process. ANSWER #5

18. Some of our corrective actions have an “ongoing” completion date. Even if all other corrective action is complete, do I have to continue submitting CAPs? QUESTION #6

19. Likely no. Corrective action is established to be an ongoing thing. Usually when corrective action indicates an “ongoing” completion date, the action has already been taken. ANSWER #6

20. Part of our department’s corrective action was contingent upon a Budget Change Proposal (BCP). What do we do if it has been denied? QUESTION #7

21. BCPs are not considered corrective action for FISMA purposes. Government Code §13407 states the provisions of FISMA should be carried out using existing resources; this includes the establishment and maintenance of internal controls. ANSWER #7