Experts warn of financial challenges and gaps in cyber implementation plan 

The long-awaited implementation plan for the White House national cybersecurity strategy provides a roadmap to bolster the nation's cyber posture, but includes "financial potholes" and other critical challenges, experts told Nextgov/FCW.

The plan includes over 65 specific initiatives for individual agencies to help achieve the vision outlined in the cybersecurity strategy released earlier this year, from tasking the Defense Department with developing an updated cyber strategy to requiring the Justice Department to ramp up its disruption campaigns targeting cybercriminals and nation-state adversaries.

Experts pointed to apparent gaps throughout the plan, noting how it lacks any initiatives around digital identity, and said that the continued challenges around funding and the cyber workforce could hinder its successful implementation. 

Robert DuPree, manager of government affairs at the security solutions firm Telos, said "there are some financial potholes" throughout the implementation plan, including recent congressional appropriations bills that zero out new funding and seek to claw back hundreds of millions of dollars for the Technology Modernization Fund. 

"It’s impossible to accelerate technology modernization with so little funding and especially if no new funding is provided," DuPree said. "The administration is going to need to find a new way forward in its multi-year plan."

A senior administration official described the plan as a "living document" during a call with reporters this week and said that it would be updated annually to address the evolving cyber threat landscape and new advancements in emerging technology. 

The annual updates will also give the administration time to fine-tune its path towards achieving the goals outlined in the national cybersecurity strategy as it works to build new funding.

Joel Krooswyk, federal chief technology officer for GitLab, suggested that artificial intelligence may help agencies as they encounter significant resource challenges throughout the implementation process by introducing new efficiencies to address existing technical debt and the use of legacy coding languages. 

"The plan seems like a 'plan to plan' rather than a plan to implement," Krooswyk told Nextgov/FCW. "We need tangible directions ... that can provide a starting point for iterative implementation."

Acting National Cyber Director Kemba Walden issued a joint memo with the Office of Management and Budget in June that required agencies to align their fiscal year 2025 budget submissions with the pillars of the national cybersecurity strategy, which include defending critical infrastructure, disrupting and dismantling threat actors, shaping market forces to drive security and investing in a resilient future.

Ilona Cohen, chief legal and policy officer for the security platform HackerOne, told Nextgov/FCW that the coordination with budget submissions "will be vital to ensuring that there is full funding for the implementation of the cyber strategy plan." 

"The administration will also need to work with Congress to ensure full adoption of its plan," she said. "With a divided Congress and narrow majorities, the legislative process will be difficult, but not impossible, given that cybersecurity is one of the few areas where bipartisan cooperation is still possible."

Experts said the plan also lacks critical details about ongoing shortages across the cyber workforce. According to the site Cyberseek, there were more than 663,000 unfilled cybersecurity positions in the U.S. between April and May of this year. 

Walden said on Thursday at an event hosted by the Information Technology Industry Council that the cyber workforce strategy would be released in the coming weeks. According to the acting director, the plan will "cover short-term needs for cyber workforce, as well as make strategic investments that we need to make in the education system and reskilling and upskilling and digital competency across the spectrum."

The implementation plan tasks the administration to develop a national cyber workforce and education strategy by the end of next March through the Office of the National Cyber Director. But the initiative will require a "reallocation of existing resources," DuPree said, in addition to "congressional buy-in during an election year." 

"That’s a lot of obstacles to overcome to achieve a meaningful outcome anytime soon to address the nation’s shortage of skilled workers," he added. 

Editors note: This article has been updated to correct the spelling of Joel Krooswyk's name.