US law requiring federal agencies (and their contractors) to implement an information-security program based on NIST standards.
FISMA (44 USC §3551 et seq., modernised 2014) requires US federal agencies to develop, document, and implement an agency-wide information-security program. Compliance is assessed against NIST SP 800-53 controls at the FIPS 199 impact level appropriate to the system.
Run a free ComplianceIQ audit against FISMA and we'll surface every gap on this — and the other controls auditors flag — with the exact clause references to fix.