Cybersecurity and Infrastructure Security Agency: Actions Needed to Ensure Organizational Changes Result in More Effective Cybersecurity for Our Nation

The Federal Government must also carefully examine what occurred during any major cyber incident and apply lessons learned. Protecting our Nation from malicious cyber actors requires the Federal Government to partner with the private sector. The private sector must adapt to the continuously changing threat environment, ensure its products are built and operate securely, and partner with the Federal Government to foster a more secure cyberspace. In the end, the trust we place in our digital infrastructure should be proportional to how trustworthy and transparent that infrastructure is, and to the consequences we will incur if that trust is misplaced.

A state agency’s information security manager, for purposes of these information security duties, shall report directly to the agency head. Establishing the managerial, operational, and technical safeguards for protecting state government data and information technology resources that align with the state agency risk management strategy and that protect the confidentiality, integrity, and availability of information and data. The recovery may include recommended improvements to the agency processes, policies, or guidelines. Completing comprehensive risk assessments and cybersecurity audits, which may be completed by a private sector vendor, and submitting completed assessments and audits to the department. The FBI leads this task force of more than 30 co-located agencies from the Intelligence Community and law enforcement.

Agencies with cybersecurity vulnerability or incident response procedures that deviate from the playbook may use such procedures only after consulting with the Director of OMB and the APNSA and demonstrating that these procedures meet or exceed the standards proposed in the playbook. Within 30 days of the date of this order, the Secretary of Commerce acting through the Director of NIST shall solicit input from the Federal Government, private sector, academia, and other appropriate actors to identify existing or develop new standards, tools, and best practices for complying with the standards, procedures, or criteria in subsection of this section. The guidelines shall include criteria that can be used to evaluate software security, include criteria to evaluate the security practices of the developers and suppliers themselves, and identify innovative tools or methods to demonstrate conformance with secure practices. The security of software used by the Federal Government is vital to the Federal Government’s ability to perform its critical functions. The development of commercial software often lacks transparency, sufficient focus on the ability of the software to resist attack, and adequate controls to prevent tampering by malicious actors. There is a pressing need to implement more rigorous and predictable mechanisms for ensuring that products function securely, and as intended.

Within 90 days of the date of this order, the Secretary of Defense, the Director of National Intelligence, and the CNSS shall review the recommendations submitted under subsection of this section and, as appropriate, establish policies that effectuate those recommendations, consistent with applicable law. Within 30 days of the date of this order, the Secretary of Homeland Security acting through the Director of CISA shall provide to the Director of OMB recommendations on options for implementing an EDR initiative, centrally located to support host-level visibility, attribution, and response regarding FCEB Information Systems. The Secretary of Homeland Security, in consultation with the Attorney General and the APNSA, shall review the recommendations provided to the President through the APNSA pursuant to subsection of this section and take steps to implement them as appropriate. The Board shall protect sensitive law enforcement, operational, business, and other confidential information that has been shared with it, consistent with applicable law. The Secretary of Homeland Security shall convene the Board following a significant cyber incident triggering the establishment of a Cyber Unified Coordination Group as provided by section V of PPD-41; at any time as directed by the President acting through the APNSA; or at any time the Secretary of Homeland Security deems necessary. After receiving the recommendations described in subsection of this section, the FAR Council shall review the recommendations and, as appropriate and consistent with applicable law, amend the FAR.

The Centre provides cyber security services to NCI Agency customers and users, as well as to all other elements of the Agency. The Surface Transportation Cybersecurity Resource Toolkit is a collection of documents designed to provide cyber risk management information to surface transportation operators with fewer than 1,000 employees. Staff salaries for personnel involved with security, contracts for security services, and other operating activities intended to increase the security of an existing or planned public transportation system. FTA has aggregated cybersecurity resources below to support transit agencies as they prepare for, mitigate, and respond to cybersecurity issues.

Until replacements can be made in customers’ installations, Fresenius Kabi recommends users rely on CISA’s recommendations for temporary alternatives. Health care delivery organizations are advised to follow the recommendations published by CISA and Fresenius Kabi to avoid cybersecurity risks that could affect the safety and essential performance of the Fresenius Kabi Agilia Connect Infusion System. Medtronic issued an Urgent Medical Device Correction to inform medical device users of this cybersecurity risk and included actions and recommendations for users to take.

The Board shall review and assess, with respect to significant cyber incidents (as defined under Presidential Policy Directive 41 of July 26, ) affecting FCEB Information Systems or non-Federal systems, threat activity, vulnerabilities, mitigation activities, and agency responses. It is the policy of my Administration that the prevention, detection, assessment, and remediation of cyber incidents is a top priority and essential to national and economic security. All Federal Information Agency Cybersecurity Systems should meet or exceed the standards and requirements for cybersecurity set forth in and issued pursuant to this order. The Cybersecurity and Infrastructure Security Agency agency has established a website with additional information that the FDA encourages medical device manufacturers to review and follow the identified recommendations to address the vulnerability. Fresenius Kabi also identified that approximatively 1,200 infusion pumps would need hardware changes.