Cybersecurity Policy Report, NSTAC Approves Report Recommending Steps to Boost Trust in ICTS Security, (Feb 22, 2023)

By Jeff Williams

The National Security Telecommunications Advisory Committee (NSTAC) yesterday unanimously adopted a report that outlines a strategy for increasing trust in the information and communications technology and services (ICTS) ecosystem.

The report, a draft of which the NSTAC released earlier this month (CPR, Feb.7), details several key findings and recommendations, including that there is an urgent need to address cyber threats in the ICT sector and that the White House should take steps to facilitate interagency cooperation on cybersecurity issues.

NSTAC Chairman Scott Charney, vice president–security policy at Microsoft Corp., noted that the report was the “fourth and final phrase” of the NSTAC’s effort to enhance Internet resilience, building upon three prior reports focused on software assurance in the ICTS supply chain, “zero trust” and trusted identity management, and information technology and operational technology convergence.

Of key findings and actionable recommendations in the report, Mr. Charney highlighted the need for a “sustained effort, especially within the federal government,” to research, deploy, and operationalize security technologies.

Citing the “clear need to sustain security efforts over long periods of time,” Mr. Charney said the report recommends integrating security efforts into existing government programs and processes.

The recommendations include that the government improve procurement language to encourage vendors to employ security best practices for all federal ICTS procurements that “align with specifically articulated zero-trust standards and best practices,” he said.

In addition, the Cybersecurity and Infrastructure Security Agency (CISA), in consultation with private and public sector partners, should work with the General Services Administration to draft “write-once, use-many” procurement language “to help federal agencies sustain security improvements over time,” Mr. Charney said.

Among other things, that language should adhere to cybersecurity guidelines adopted by the National Institute of Standards and Technology (NIST), he said.

The report also recommends enhancing CISA’s continuous diagnostics and mitigation (CDM) program “to ensure sustained application” of security best practices, Mr. Charney said.

Among other things, doing so could assist in gathering accurate inventory information and managing distribution of software patches, he said.

In addition, Mr. Charney discussed the report’s call to “maximize” the use of automation and the reuse of evidence when assessing Federal Information Security Management Act (FISMA) compliance.

“Federal shared services programs should work toward a consistent approach for assessing implementation of FISMA requirements and systems,” he said.

The report also found that “growing concerns about cybersecurity risks have caused requirements and assurance programs to dramatically increase, … sometimes diverting resources from improving security,” Mr. Charney said.

There is also a “critical” need for harmonization in abiding by cybersecurity guidelines across federal agencies, he said.

The report recommended the executive branch establish an Office of Cybersecurity Regulatory Harmonization (OCRH) within CISA, “with the primary mission of driving regulatory harmonization,” he said.

There is a “strong need for a group of individuals who have both an in-depth expertise in cybersecurity regulations and a vision for how to use consensus standards to reduce existing cacophony, confusion, and costs,” Mr. Charney said, adding that the office would “exist in an advise-and-assist capacity to regulators” and would not have its own rulemaking authority.

The report also recommends that the president “explicitly establish cybersecurity regulatory harmonization as a regulatory principle” and require that rulemakings “align to consensus standards,” he said.

News: FederalLegislation DataSecurity