Cybersecurity Policy Report, White House Wants Baseline Cyber Rules for All Critical Infrastructure, (May 1, 2024)
The Biden administration intends to seek additional legislative authority to impose minimum cybersecurity requirements on any critical infrastructure sectors that aren’t covered by existing cybersecurity statutes, according to a national security memorandum (NSM) signed yesterday by President Biden.
The NSM elevates the role of the Cybersecurity and Infrastructure Security Agency (CISA) as the “national coordinator” to oversee the federal government’s efforts to protect critical infrastructure from cyber attacks and other hazards and directs it to work with other federal agencies to identify critical infrastructure sectors that lack adequate protections.
The NSM replaces an existing executive branch directive on critical infrastructure protection, Presidential Policy Directive 21, which was issued in 2013 before CISA’s creation in 2018.
“The statute that established CISA in 2018 tasked us ... to lead a national effort to secure critical infrastructure, but the presidential policy directive that was created in 2013 didn’t mention anything about CISA’s role because we weren’t created yet,” a senior official explained during a White House news briefing.
In CISA’s new role as national coordinator, it will work with other federal agencies that have specific responsibilities as sector risk management agencies (SRMAs) to oversee particular critical infrastructure sectors, such as food and agriculture or water and wastewater.
The NSM requires CISA and the SRMAs to identify, within 270 days, security vulnerabilities within each critical infrastructure sector and propose ways to close them, including the use of legislation.
While the NSM takes aim at all sorts of threats to critical infrastructure, it highlights cybersecurity as a particular concern, and its language suggests that the administration will either seek new legislative powers to address cyber gaps within critical infrastructure sectors or try to use existing laws to cover those gaps.
CISA and the SRMAs will review the “available authorities, incentives, and other tools to encourage and require” critical infrastructure operators to adopt “minimum security and resilience requirements,” the NSM says.
“This review should focus on identifying the most critical gaps in the Federal Government’s capacity to require and enforce minimum security and resilience requirements for critical infrastructure,” it says.
Following the review, CISA and the SRMAs will be expected to send the White House legislative proposals “for any necessary additional authorities or capabilities that could enable the implementation of these minimum security and resilience requirements for critical infrastructure,” according to the NSM.
The White House noted in a fact sheet that the NSM reflected the determination in the National Cybersecurity Strategy issued last year that “a voluntary approach to risk management in the current threat environment” was inadequate to protect national security.
“The Nation faces an era of strategic competition in which nation-state actors will continue to target American critical infrastructure—and tolerate or enable malicious activity conducted by non-state actors,” according the fact sheet.
“In the event of crisis or conflict, America’s adversaries may attempt to compromise our critical infrastructure to undermine the will of the American public and impede the functioning of the economy and projection of U.S. military power abroad. Resilience, particularly for our most sensitive assets and systems, is the cornerstone of homeland defense and security,” it says.
The NSM also directs CISA to identify systemically important entities (SIEs)—the most critical of critical infrastructure. CISA “shall regularly identify organizations that own, operate, or otherwise control critical infrastructure that is prioritized based on the potential for its disruption or malfunction to cause nationally significant and cascading negative impacts to national security (including national defense and continuity of Government), national economic security, or national public health or safety,” it says.
The list of SIEs, which won’t be made public, “shall inform prioritization of Federal activities, including the provision of risk mitigation information and other operational resources to non-Federal entities,” the NSM says.
In recent years, Congress has considered legislation that would task CISA with identifying SIEs—also known as systemically important critical infrastructure (SICI). But the legislation faced pushback from the banking and telecom sectors, among others, that might have faced additional regulations (CPR, April 28, 2023).
But CISA proceeded in the absence of legislation to begin identifying SIEs, CISA Director Jen Easterly told reporters at the White House briefing. “We’ve begun the work to establish systemically important entities—that critical infrastructure, which is prioritized based on the potential for disruption or malfunction to cause nationally significant and cascading negative impacts to national security and economic security or public health and safety,” she said.
“That SIE list will inform prioritization of federal activities, including risk mitigation efforts and other operational resources to non-federal entities,” she added.
The NSM also envisions a role for the FCC to engage with entities it regulates to ensure they address national security threats, while acknowledging that the Commission is an independent agency that the White House doesn’t directly oversee.
The FCC should “(1) identify and prioritize communications infrastructure by collecting information regarding communications networks; (2) assess communications sector risks and work to mitigate those risks by requiring, as appropriate, regulated entities to take specific actions to protect communications networks and infrastructure; and (3) collaborate with communications sector industry members, foreign governments, international organizations, and other stakeholders to identify best practices and impose corresponding regulations,” according to the NSM.
Another key provision of the NSM is its directive to the U.S intelligence community to provide as much classified information as possible to critical infrastructure entities about potential threats.
“The appropriate sharing of timely, actionable information, which may include relevant classified and unclassified intelligence and law enforcement sensitive information, among Federal, State, local, Tribal, and territorial entities; owners and operators; and other relevant stakeholders, is essential for effective risk management,” it says. “The Federal Government will support a robust information sharing environment and public-private cooperation that enables actions and outcomes that reduce risk.”
News: DataSecurity FederalLegislation