OMB Memo Places Zero Trust at the Top of Civilian Agency Priorities

The Office of Management and Budget in July quietly issued a memorandum to all federal civilian agencies outlining the administration’s “cross-agency cyber investment priorities” for the fiscal year 2024 budget, emphasizing that implementing zero trust and IT modernization must be at the top of the list.

“The Federal Zero Trust Strategy … requires agencies to achieve specific zero trust security goals by the end of FY 2024; budget submissions are expected to prioritize ensuring this work is completed,” the memo states. “Agencies have submitted [their] zero trust implementation plans to OMB, and a cross-government team of cybersecurity experts from OMB, [Office of the National Cyber Director], and Cybersecurity and Infrastructure Security Agency … is engaging with agencies to refine these plans and define ambitious, achievable goals.”

OMB noted that the goals of a zero trust implementation are about achieving a consistent enterprise-wide baseline for cybersecurity “grounded in principles of least privilege, minimizing attack surface and designing protections around an assumption that agency perimeters should be considered compromised.”

The budget directive is aimed at ensuring that agencies demonstrate their commitment to zero trust by reflecting it in their budget requests. 

Similarly, the memo points out that obsolete systems and the resulting technical debt have limited both the government’s ability to deliver modern services to customers and also in the implementation of modern security best practices. As a result, the memo emphasizes that agencies “should prioritize technology modernizations that lead with security integrated during the design phase, as well as throughout the system lifecycle.” This includes:

• Accelerating adoption and use of secure cloud infrastructure and services, leveraging zero trust architecture.

• Developing and deploying federal shared products, services and standards that empower secure customer experiences.

• Using shared security technologies, including the Department of Homeland Security’s Continuous Diagnostics and Mitigation program.

• Sharing awareness between security and IT operations teams across the federal enterprise.

• Using agile development practices and integrating NIST’s Secure Software Development Framework and Software Supply Chain Security Guidance into agencies’ software procurement and development practices.

The memo also directs the civilian agencies to increase their collaboration with the private sector to protect critical infrastructure. Sector Risk Management Agencies “must ensure their [budget] requests reflect adequate resources to fulfill their responsibilities,” including building mechanisms to collaborate with critical infrastructure owners and operators to “identify, understand and mitigate threats, vulnerabilities and risks to respective sectors.” Budget submissions for FY 2024 should prioritize specific proposals that will provide SRMAs adequate resources to meet those responsibilities.

OMB also points out that supply chain risk management is a “critical capability to manage cybersecurity risk.” While agencies have been required to establish formal SCRM programs for their own acquisitions—especially for information and communications technology and services—the requirements are slated to sunset at the end of 2023. OMB advises the agencies that legislation is pending to extend the requirement through 2026, so agencies should continue their investments in their FY 2024 budget submissions.

And agencies’ responsibilities for supply chain risk management extend beyond their own acquisitions, the memo says.

“The federal government also plays a role in addressing national level ICTS supply chain risk,” it states. “In FY 2024 budget submissions, agencies should highlight investments that support a national effort to mitigate undue or unacceptable levels of risk to [the] economic security and national security of the United States.”

This OMB memo is a real ratcheting-up of pressure on federal civilian agencies to implement zero trust. Since last year’s cybersecurity EO, some agencies have grumbled that it represented another "unfunded mandate"—an IT directive without the budget attached to achieve it.

James F.X. Payne, vice president, business development with SecureG, a Sterling, Virginia, company developing secure machine identity management for 5G wireless services, said the OMB memorandum shows the agency is making sure that excuses for a lack of progress will not stand up to scrutiny.

OMB “is embracing zero trust architecture in a serious way. It's a wake-up call across the government,” he said.

Payne compared it to the way the White House stepped up pressure on agencies to adopt cloud computing more than a decade ago. “First it was a suggestion. Then it was a directive. And then it was, ‘We'll audit you for compliance,’” he said. “Moving to zero trust is important enough, OMB is moving faster this time.”