FISMA vs BREEAM

What It Is

Federal Information Security Modernization Act (FISMA) is a U.S. federal law establishing a risk-based framework for protecting federal information and systems. Enacted in 2002 and modernized in 2014, it mandates agency-wide information security programs using the NIST Risk Management Framework (RMF) with seven steps: Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor.

Key Components

• NIST SP 800-53 controls tailored by FIPS 199 impact levels (Low/Moderate/High).
• Continuous monitoring via SP 800-137 and CDM tools.
• System Security Plans (SSPs), POA&Ms, and Authorizations to Operate (ATOs).
• Oversight through OMB policy, CISA metrics, and IG evaluations using maturity models.

Why Organizations Use It

Federal agencies and contractors must comply to avoid IG downgrades, contract losses, and funding cuts. It reduces breach risks, enables market access (e.g., FedRAMP), and builds resilience via integrated risk management.

Implementation Overview

Phased RMF application: inventory assets, categorize systems, deploy controls, assess continuously. Applies to all federal executive agencies, contractors handling federal data; requires annual reporting, no central certification but IG audits.

What It Is

BREEAM (Building Research Establishment Environmental Assessment Method) is a science-led sustainability assessment and certification framework for the built environment. It evaluates performance across buildings, infrastructure, and communities throughout their lifecycle, using a credit-based, weighted scoring methodology that translates sustainability measures into ratings from Pass to Outstanding.

Key Components

• Core categories: Management, Health & Wellbeing, Energy, Transport, Water, Materials, Waste, Land Use & Ecology, Pollution, Innovation (10 primary domains).
• Credits awarded for compliance with issue-specific criteria, evidence requirements, and prerequisites.
• Built on third-party assurance via licensed assessors and BRE Global audits.
• Certification model includes design-stage and post-construction stages, with ongoing updates through Knowledge Base Compliance Notes (KBCNs).

Why Organizations Use It

• Drives operational savings (e.g., 22-33% energy reductions), asset value uplift (up to 30%), and ESG alignment.
• Supports regulatory incentives, tenant demands, and investor requirements like EU Taxonomy.
• Mitigates risks in climate resilience, greenwashing, and performance gaps.
• Enhances market differentiation and stakeholder trust via credible ratings.

Implementation Overview

• Phased approach: early assessor appointment, pre-assessment, evidence gathering, BRE QA.
• Applies to all sizes, built environment sectors, globally with local adaptations.
• Requires licensed assessors; certification via BRE Global.