In the story, Alan Paller, director of research at the SANS Institute, a nonprofit cybersecurity research group, blamed NIST for some of FISMA's failings. He said NIST's guidelines are too broad and he claimed that "the people at NIST, if they ever ran IT systems, it's been decades."

Since the piece was written on a tight deadline, I was unable to reach out to get a reaction from NIST at the time, so Ron Ross, leader of NIST's FISMA implementation project offered up some thoughts on Monday (per my suggestion). So, here goes...