Cybersecurity Policy Report, CISA Aims to Herd Agencies Toward Safer Cyber Future, (Sep 17, 2024)
A plan to align the network protection efforts of more than 100 federal civilian executive branch (FCEB) agencies has been released by the Cybersecurity and Infrastructure Security Agency.
The Federal Civilian Executive Branch (FCEB) Operational Cybersecurity Alignment (FOCAL) Plan requires agencies to, among other things, maintain inventories of their network assets and regularly scan networks for known vulnerabilities, according to the plan published yesterday.
“Each FCEB agency has a unique mission, and thus have independent networks and system architectures to advance their critical work. This independence means that agencies have different cyber risk tolerance and strategies,” CISA noted in a news release.
“However, a collective approach to cybersecurity reduces risk across the interagency generally and at each agency specifically, and the FOCAL Plan outlines how this will occur,” CISA said.
“Agencies vary widely in how effective they are at managing cyber risk, which means there is no cohesive or consistent baseline security posture across all FCEB agencies,” the plan says.
“These diverse approaches were not designed to collectively address the dynamic nature of our current cyber threat environment, the complexity of our digital ecosystem, and the pace of technology modernization. As a result, despite concerted efforts to adapt and protect against cyberattacks, the FCEB remains vulnerable,” it adds.
CISA describes the plan as “a strategic document that includes broad organizing concepts for federal cybersecurity and a tactical one that provides specific actionable steps agencies can take in the next year to improve their cybersecurity posture.”
“The ultimate destination on this shared journey is more synchronized and robust cyber defenses, greater communication, and increased agility and resilience across the federal enterprise, resulting in a more cohesive government enterprise capable of defending itself against evolving cyber threats,” the plan says.
The plan requires agencies to take action in the following five areas: (1) network asset management, (2) vulnerability detection and mitigation, (3) defensible and resilient network configuration, (4) cyber supply chain risk management, and (5) incident detection and response.
“Federal government data and systems interconnect and are always a target for our adversaries,” said Jeff Greene, CISA’s executive assistant director–cybersecurity.
“FCEB agencies need to confront this threat in a unified manner and reduce risk proactively,” Mr. Greene added. “The actions in the FOCAL plan orient and guide FCEB agencies toward effective and collaborative operational cybersecurity and will build resilience. In collaboration with our partner agencies, CISA is modernizing federal agency cybersecurity.”
News: FederalLegislation DataSecurity