https://en.wikipedia.org/wiki/Federal_Information_Security_Management_Act_of_2002

You can use it although you might consider the Iso accredited NIST model 800-100 series. 800-171 deals with compliance. We use that in the commercial sector at work. If your looking for federal compliance I suggest looking at the DISA STIG https://public.cyber.mil/stigs/ for guidance.

it would be better if you call it protocol not model

Thanks for the good comment and note