You can usually find these settings in the Options or Preferences menu of your Happy EOnniversary: One Year of Action Since President Bidens Cybersecurity Executive Order, Public Policy, Regulatory & Political Law, Executive Order on Improving the Nations Cybersecurity, https://www.acq.osd.mil/dpap/dars/opencases/farcasenum/far.pdf, https://www.nist.gov/system/files/documents/2021/07/09/Critical Software Use Security Measures Guidance.pdf, https://www.ntia.doc.gov/files/ntia/publications/sbom_minimum_elements_report.pdf, https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-30.pdf, https://www.nist.gov/system/files/documents/2021/10/13/EO Critical FINAL.pdf, https://nvlpubs.nist.gov/nistpubs/ir/2021/NIST.IR.8397.pdf, https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-218.pdf, https://www.nist.gov/system/files/documents/2022/02/04/software-supply-chain-security-guidance-under-EO-14028-section-4e.pdf, https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.02042022-1.pdf, https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.02042022-2.pdf, https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202120220AB2392, https://www.nist.gov/system/files/documents/2022/03/07/EO 4k implementation questions.pdf, https://www.whitehouse.gov/omb/briefing-room/2022/03/07/omb-statement-on-enhancing-the-security-of-federally-procured-software, https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-161r1.pdf, https://www.nist.gov/itl/executive-order-14028-improving-nations-cybersecurity/cybersecurity-labeling-consumers-0, https://www.dhs.gov/news/2022/02/03/dhs-launches-first-ever-cyber-safety-review-board, https://www.cisa.gov/sites/default/files/publications/CISA Zero Trust Maturity Model_Draft.pdf, https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf, https://www.cisa.gov/sites/default/files/publications/Federal_Government_Cybersecurity_Incident_and_Vulnerability_Response_Playbooks_508C.pdf, https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf, https://www.cisa.gov/sites/default/files/publications/Zero_Trust_Principles_Enterprise_Mobility_For_Public_Comment_508C.pdf, In July 2021, NIST issued guidance defining EO-critical software and outlining fundamental security measures for EO-critical software use.. Mike Wagner helps government contractors navigate high-stakes enforcement matters and complex regulatory regimes. This blog describes key actions taken to implement the Cyber EO during June 2022. 19 See https://www.cisa.gov/sites/default/files/publications/Federal_Government_Cybersecurity_Incident_and_Vulnerability_Response_Playbooks_508C.pdf. If you opt out we will not be able to offer you personalised ads and CISA Releases Version 2.0 of Its Cloud Security Technical Reference Architecture. She works with clients to navigate the complex rules and regulations that govern federal procurement and her practice includes both counseling and litigation components. It is clear the government has also been following through on the promise of the EO to improve federal cybersecurity. The Biden administration has undertaken numerous initiatives under the Cyber EO, many of which have important implications for private sector entities with respect to their contracts with the government, incident reporting and response, software security, and more. NIST Issues Final Draft Guidance on Engineering Secure Systems. Emma Merrill is an associate in the firms Washington, DC office. The individuals who successfully complete this program are eligible for 4 Continuous Learning Points (CLPs). NIST releases summary reporton Progress Implementing Section 4 of Executive Order 14028 (July 11, 2022), NIST releases summary report on the labeling initiatives under the EO (May 24, 2022), New EO Guidance for Cybersecurity Supply Chain Risk Management (May 5, 2022), NIST Issues Guidance on Software, IoT Security and Labeling (February 4, 2022), Cybersecurity Labeling for Consumer IoT and Software: Executive Order Update and Discussion (December 9, 2021), 2nd Public Draft SP 800-161 Revision 1 Workshop (December 1, 2021), Executive Order 14028: Guidelines for Enhancing Software Supply Chain Security (November 8, 2021), Webmaster | Contact Us | Our Other Offices, Assistant to the President for National Security Affairs, Manufacturing Extension Partnership (MEP), EO-Critical Software and Security Measures for EO-Critical Software, Software Cybersecurity for Producers and Users, Attesting to Conformity with Secure Software Development Practices, Evolving Standards, Tools, and Recommended Practices, Additional Existing Industry Standards, Tools, and Recommended Practices, Software Cybersecurity for Producers and Purchasers, Security Measures for Critical Software Use, Security Measures for EO-Critical Software Use, Recommended Minimum Standard for Vendor or Developer Verification of Code, Consumer Cybersecurity Labeling Pilots: The Approach and Contributions, Workshops on Cybersecurity Labeling of Consumer Products, guidance outlining security measures forcritical software, guidelines recommending minimum standards for vendors testing of their software source code, IoT cybersecurity criteria for a consumer labeling program. Karim Said and Theodore Gates will work through the reaching implications of modernization from an EO perspective and how it will relate to the goal of driving towards near-real-time risk visibility. language preference or login information. In his contract disputes and advisory work, Mr. Wagner helps government contractors resolve complex issues arising at all stages of the public procurement process. The first blog summarized the Cyber EOs key provisions and timelines, and the subsequent blogs described the actions taken by various Government agencies to implement the Cyber EO from June 2021 through May 2022. Strengthening the nations cybersecurity has been a top priority for the Biden administration, as reflected in its collaboration with industry, regulatory actions, and the legislation it has supported in Congress, including the Cyber Incident Reporting for Critical Infrastructure Act of 2022. By continuing to use this site, you agree to our use of cookies. These cookies are not used in a way that constitutes a sale of More specifically, we use cookies and other tracking One year later, what are the accomplishments especially on the seven key points that the Executive Order looked to address? Get top federal technology stories and news alerts in your inbox. Christopher Chilbert, Chief Information Security Officer, Consumer Financial Protection Bureau Description:At the heart of several of the Executive Order actions is data. 12 See https://www.nist.gov/system/files/documents/2022/03/07/EO 4k implementation questions.pdf. 10See https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.02042022-2.pdf. NIST publishedguidance outlining security measures forcritical softwarebyJuly 11, 2021, after consulting with CISA and OMB. If you do not allow these cookies you may not be 4 See https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-30.pdf. When you visit our website, we store cookies on your browser to collect information by using this toggle switch. Rights link. NIST took several steps in June 2022 in furtherance of its IoT Cybersecurity Program. He has particular expertise representing individuals and companies in suspension and debarment proceedings, and he has successfully resolved numerous such matters at both the agency and district court level. We represent clients of all sizes, across all government agencies, and at all stages of the public procurement process. 21 See https://www.cisa.gov/sites/default/files/publications/Zero_Trust_Principles_Enterprise_Mobility_For_Public_Comment_508C.pdf. 9 See https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.02042022-1.pdf. of the site will not work as intended if you do so. The information collected might relate to you, your preferences or your device, and is mostly More specifically, the Cybersecurity and Infrastructure Security Agency, supported by other federal agencies, has continued to update cybersecurity warnings based on evolving threat intelligence. On June 7, 2022, the National Institute of Standards and Technology (NIST) issued a final draft of its Special Publication (SP) 800-160, Volume 1, Revision 1, titled Engineering Trustworthy Secure Systems. According to NIST, the updated draft publication provides a renewed emphasis on the importance of systems engineering and viewing systems security engineering as a critical sub-discipline necessary to achieving trustworthy secure systems. The draft provides systems engineers with design principles and a methodology for developing trustworthy secure systems, it clarifies key systems engineering and systems security engineering terminology, and provides additional references to international standards and technical guidance to support the security aspects of the systems engineering process. A locked padlock your data under the CCPA. On January 19, 2022, President Biden issued National Security Memorandum-8, Memorandum on Improving the Cybersecurity of National Security, Department of Defense, and Intelligence Community Systems, addressing the Cyber EOs Section 9 directives related to National Security Systems, independent of civilian systems. Theodore Gates, Director of Cybersecurity Business, NewWave Combining deep regulatory knowledge with extensive investigations experience, Mr. Wagner works closely with contractors across a range of industries to achieve the efficient resolution of regulatory enforcement actions and government. In October 2021, NIST issued Guidelines on Minimum Standards for Developer Verification of Software, pursuant to Section 4(e) of the Cyber EO, recommending minimum source code testing for federal government software vendors. Emerging Technology and Innovation Conference 2023 (Save the Date May 7-9), Imagine Nation ELC 2023 (Save the Date Oct 29-31), Homeland Security and Law Enforcement Forum 2022, Cybersecurity Summit and U.S. Cyber Challenge 2022, Sample Application - preview purposes only, Cybersecurity Forum 2022: One year Review of the Executive Order on Improving the Nations Cybersecurity, https://www.actiac.org/act-iac-privacy-statement, Remove Barriers to Threat Information Sharing Between Government and the Private Sector, Modernize and Implement Stronger Cybersecurity Standards in the Federal Government, Establish a Cybersecurity Safety Review Board, Create a Standard Playbook for Responding to Cyber Incidents, Improve Detection of Cybersecurity Incidents on Federal Government Networks, Improve Investigative and Remediation Capabilities, Provide an update on changes that have occurred with the Cyber Executive Order in place, Hear about what still needs to be accomplished to meet the specified requirements. Looking back, while the cybersecurity executive order itself did not directly address longstanding critical infrastructure vulnerabilities, the government has taken action in other wayssome based on the direction and tone of the EO and some in response to eventsto assist private sector cybersecurity. browser. All rights reserved. ensure the proper functioning of our Our institutional knowledge and subject-matter expertise allow us to devise creative and successful legal strategies to enhance our clients competitiveness while protecting their ability to do business with the government. NIST consulted with the National Security Agency (NSA), Office of Management and Budget (OMB), Cybersecurity &Infrastructure SecurityAgency(CISA), and the Director of National Intelligence (DNI)andthendefined critical softwarebyJune 26, 2021. We also share information about your use of our site with our social media, advertising 2022 by Government Media Executive Group LLC. As lead counsel, he has successfully litigated disputes at the Armed Services Board of Contract Appeals, and he regularly assists contractors in preparing and pursuing contract claims. Ryan Burnette advises clients on a range of issues related to government contracting. Amyn Gilani, Chief Growth Officer, CounterCraft Kshemendra Paul, Chief Data Officer, and Executive Director, Department of Veterans Affairs The EO also assignsNIST to work ontwolabelingefforts related to consumer Internet of Things (IoT) devices and consumer software with the goal of encouraging manufacturers to produce and purchasers to be informed about products created with greater consideration of cybersecurity risks and capabilities. Below, we provide a high-level summary of key actions taken pursuant to the Cyber EO in the past year, as well as key actions directed by the Cyber EO that remain forthcoming. see some advertising, regardless of your selection. American Council for Technology and Industry Advisory Council. Moreover, it shows how the government is extending the EOs impact beyond the federal space and into the private sector. Federal Chief Information Security Officer and Deputy National Cyber Director Chris DeRusha will provide an overview of the last years EO accomplishments and explore the near horizon and strategic follow-ons related to the Cybersecurity Executive Order. Section 4 directs NIST tosolicitinputfromthe private sector, academia,government agencies,and othersandto identify existing or develop newstandards,tools, best practices, and other guidelinesto enhance software supply chain security. can set your browser to block or alert you about these cookies, but some parts of the site will not work as and analytics partners. 20 See https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf. We do not allow you to opt-out of our certain cookies, as they are necessary to Personal Information. While not immediately relevant to businesses, the actions taken under these sections may serve as helpful guides for cybersecurity best practices and potential future cybersecurity-related actions that may be undertaken by the federal government. Draft Standard Contracts Finally Released in China. Section 5 of the Cyber EO directed the establishment of a Cyber Safety Review Board (the Board) to review threat activity, vulnerabilities, mitigation activities, and agency responses after significant cyber incidents. The Board was established by the Department of Homeland Security on February 3, 2022, and is composed of federal government and private sector leaders.16 The Boards first task, anticipated this summer, will focus on the widespread Log4j vulnerabilities. Prior to joining Covington, Mr. Burnette served in the Office of Federal Procurement Policy in the Executive Office of the President, where he worked on government-wide contracting regulations and administrative actions affecting more than $400 billion dollars worth of goods and services each year. ) or https:// means youve safely connected to the .gov website. 2). In June 2021, CISA released a pre-decisional Zero Trust Maturity Model, pursuant to Section 3(b)(ii) of the Cyber EO, to serve as a roadmap for the federal governments transition to a zero-trust architecture. Amyn Gilani,Chief Growth Officer, CounterCraft content and messages you see on other websites you visit. By registering for this event, as has been the practice for years, event sponsors are provided a directory of attendees which they agree not to use for mass marketing purposes. The Biden administration has followed up on this by giving specific direction to federal agencies to move more aggressively to adopt cloud computing and zero trust architecture. Key, publicly available actions include: 1 See https://www.acq.osd.mil/dpap/dars/opencases/farcasenum/far.pdf. internet device. A lock ( Federal Government Cybersecurity (Secs. Enhancing Cyber Information Sharing (Sec. Visit www.allaboutcookies.org No-shows will be charged the full registration fee. performance. to learn more. She advises clients on a broad range of issues related to government contracting, including both regulatory and transactional matters. They do not store directly personal information, but are based on uniquely identifying your browser and website. Preferences menu of your browser. A cookie is a small piece of data (text file) that a website when visited by a personalize your experience with targeted ads. NIST solicitedinputfromthe private sector, academia,government agencies,and othersthrough multiple requests for position papers, comments on drafts, presentations, and discussions at heavily attended virtual workshops, briefings and listening sessions. Description:Several of the ambitious goals of the Cybersecurity Executive Order will require new ways of thinking about cyber security technology and development. And he routinely assists contractors in navigating issues and disputes that arise during negotiations over teaming agreements and subcontracts. He also has extensive experience litigating contract and related issues before the Court of Federal Claims, the Armed Services Board of Contract Appeals, federal district courts, the Federal Circuit, and other federal appellate courts.