The memorandum sets up budget expectations for previously established cyber goals.
The Office of Management and Budget in July quietly issued a memorandum to all federal civilian agencies outlining the administration’s “cross-agency cyber investment priorities” for the fiscal year 2024 budget, emphasizing that implementing zero trust and IT modernization must be at the top of the list.
“The Federal Zero Trust Strategy … requires agencies to achieve specific zero trust security goals by the end of FY 2024; budget submissions are expected to prioritize ensuring this work is completed,” the memo states. “Agencies have submitted [their] zero trust implementation plans to OMB, and a cross-government team of cybersecurity experts from OMB, [Office of the National Cyber Director], and Cybersecurity and Infrastructure Security Agency … is engaging with agencies to refine these plans and define ambitious, achievable goals.”
OMB noted that the goals of a zero trust implementation are about achieving a consistent enterprise-wide baseline for cybersecurity “grounded in principles of least privilege, minimizing attack surface and designing protections around an assumption that agency perimeters should be considered compromised.”
The budget directive is aimed at ensuring that agencies demonstrate their commitment to zero trust by reflecting it in their budget requests.
Similarly, the memo points out that obsolete systems and the resulting technical debt have limited both the government’s ability to deliver modern services to customers and also in the implementation of modern security best practices. As a result, the memo emphasizes that agencies “should prioritize technology modernizations that lead with security integrated during the design phase, as well as throughout the system lifecycle.” This includes:
- Accelerating adoption and use of secure cloud infrastructure and services, leveraging zero trust architecture.
- Developing and deploying federal shared products, services and standards that empower secure customer experiences.
- Using shared security technologies, including the Department of Homeland Security’s Continuous Diagnostics and Mitigation program.
- Sharing awareness between security and IT operations teams across the federal enterprise.
- Using agile development practices and integrating NIST’s Secure Software Development Framework and Software Supply Chain Security Guidance into agencies’ software procurement and development practices.
The memo also directs the civilian agencies to increase their collaboration with the private sector to protect critical infrastructure. Sector Risk Management Agencies “must ensure their [budget] requests reflect adequate resources to fulfill their responsibilities,” including building mechanisms to collaborate with critical infrastructure owners and operators to “identify, understand and mitigate threats, vulnerabilities and risks to respective sectors.” Budget submissions for FY 2024 should prioritize specific proposals that will provide SRMAs adequate resources to meet those responsibilities.
OMB also points out that supply chain risk management is a “critical capability to manage cybersecurity risk.” While agencies have been required to establish formal SCRM programs for their own acquisitions—especially for information and communications technology and services—the requirements are slated to sunset at the end of 2023. OMB advises the agencies that legislation is pending to extend the requirement through 2026, so agencies should continue their investments in their FY 2024 budget submissions.
And agencies’ responsibilities for supply chain risk management extend beyond their own acquisitions, the memo says.
Source:
