Call us now:
Well worth reading, the August 2021 Federal cybersecurity report to the Senate Committee on Homeland Security and Government Affairs. Highlighting the current issues with cybersecurity across 8 Federal Departments. covering DHS, State, Transportation, Housing, Agriculture, Health, Education and Administration.
The report highlights the challenges faced by all Federal Agencies with providing cybersecurity.
1. Six Agencies operated systems without a current ATO.
2. Seven agencies used legacy systems or applications no longer supported by vendors.
3. Six Agencies failed to install security patches and other vulnerability remediation controls quickly.
4. Seven agencies failed to operate accurate and comprehensive information asset inventories.
5. Seven Agencies failed to protect PII.
FISMA and NIST are important baselines referenced in the report. With the FISMA 2014 revision requiring OMB to develop and oversea ‘the implementation of policies, standards and guidelines on information security’ and to ‘oversea agency compliance with requirements’. FISMA requires DHS develop and oversea those policies, standards and guidelines set by OMB, working with NIST.
The 2014 Cybersecurity Enhancement Act updated NIST’s role ‘to facilitate and support the development of a voluntary, consensus-based, industry led set of standards, guidelines, best practices, methodologies, procedures and processes to cost effectively reduce cyber-risk to critical infrastructure.’
Amongst other legislation, FISMA sets out the risk-based methodology for cybersecurity assessment through the Risk Management Framework, and the NIST Cybersecurity Framework(CSF) an enterprise wide cybersecurity standard.
When one reads the report and the gaps identified, some of which are fundamental, such as asset management. One cannot help but remark that all the appropriate legislative tools were in place to implement cybersecurity across federal government. Concluding that the challenge has been one of implementation.
Ted Dziekanowski‚Â Jason Spezzano‚Â Brian McCarthy
#theaugustagroup‚Â #theaugustaplan‚Â #cybersecurity‚Â #SupplyChainRiskManagement‚Â #CyberRiskManagement‚Â #compliance‚Â #cyberinsurance‚Â #insurance‚Â #regulatorycompliance‚Â #regulatoryoversight‚Â #esgrisk‚Â #cyberregulation‚Â #esgreporting‚Â #soc2‚Â #defenceindustry‚Â #esg‚Â #defence
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3AugcPost%3A6835489051273900032