White House embeds cyber EO in FISMA reporting

The Biden administration’s cybersecurity executive order is playing out in required annual compliance statements under the Federal Information Security Modernization Act (FISMA).

The Office of Management and Budget issued a memorandum signed by Jason Miller, deputy director for management, on Monday reminding agencies of their obligations under FISMA and incorporating elements of the May executive order into the FISMA data reporting compliance routine.

“As federal agencies face ever more sophisticated attempts to compromise government systems, it is vital that agency security efforts are focused on making it demonstrably harder for our adversaries to succeed,” federal Chief Information Security Officer Chris DeRusha said in a statement. “OMB’s updated FISMA guidance is designed to help agencies focus on practical security outcomes by measuring the use of rigorous multi-layered security testing, automation of security and compliance controls, and progress in adopting a zero trust architecture.”

The new guidance, which covers all non-national security systems across the federal government, incorporates requirements covering multifactor authentication and data encryption into FISMA reporting. It also sets the stage for agencies to rely more on automated, machine-to-machine cybersecurity data collection and collation when preparing FISMA submissions.

Officials are also being told that simply signing off on a compliance report is no longer sufficient to demonstrate agency information security.

“Traditionally, we have relied heavily on self-attestation of security control implementation, and there is a need to accelerate efforts to validate and verify those attestations,” Miller stated in the Dec. 6 memo. “The federal government must rely more on methods that empirically validate security and find weaknesses, such as manual and automated penetration testing and red team exercises.”

An appendix to the memo reminds agencies that “no prior agency authorization is needed for one Federal agency to perform non-invasive vulnerability scanning of another federal agency’s internet-accessible systems.” Agencies should expect that their public-facing systems are “being scanned for vulnerabilities by various parties at all times, and factor this into their security operations accordingly.”

The memo also instructs agencies to keep the Cybersecurity and Infrastructure Security Agency at the Department of Homeland Security up to date on their portfolio of public-facing websites and other information services.

OMB is also pressing agencies on the transformation to zero-trust security architecture. The memo sets forth five areas – identity, devices, networks, applications and data – where work is needed to make the federal enterprise more resistant to attacks and more resilient when it comes to recovery.

Agencies are also tasked with adopting CISA’s incident reporting and response playbook when making required disclosures of hacks so that federal officials are using standardized language and definitions for breach reporting.

Additionally, the memo heralds some changes to the annual FISMA reporting cycle, designed to give agencies earlier access to reports from agency inspectors general on potential problems. That means agencies will have to release some information security metrics in July of next year, rather than October under the previous schedule. Agencies that can’t hit the new deadline can obtain extensions.