New White House cyber implementation plan looks to ramp up resilience

The White House released its long-awaited implementation plan for the national cybersecurity strategy, offering federal agencies a roadmap with specific initiatives and requirements to bolster national security and improve long-term resilience against major cyberattacks. 

Senior White House officials described the 57-page plan as a "living document" during a phone call with reporters on Wednesday, saying that the guidance will be updated annually to meet emerging threats targeting the federal government. 

The plan features more than 65 "high-impact initiatives," each assigned to a designated agency, that align with the five pillars of the cybersecurity strategy released earlier this year: defending critical infrastructure, disrupting and dismantling threat actors, shaping market forces to drive security and investing in a resilient future. 

The Cybersecurity and Infrastructure Security Agency will lead public-private partnerships and scale those collaborative efforts to drive the development and adoption of secure-by-design and secure-by-default technologies. The Department of Defense is tasked with publishing an updated departmentwide cyber strategy that focuses on "challenges posed by nation-states and other malicious actors whose capabilities or campaigns pose a strategic-level threat."

The plan also requires the Department of Justice to increase the speed and volume of its disruption campaigns targeting cybercriminals and nation-state adversaries, and it tasks several entities across the intelligence community with leading the development of "a menu of options" to coordinate and execute disruption operations. 

The plan comes amid growing concerns that agencies lack the resources and staff to successfully achieve the objectives outlined in the national cyber strategy, while industry groups have increasingly called on the White House to nominate a replacement to former National Cyber Director Chris Inglis, following his retirement earlier this year. On Wednesday, the Cybersecurity Coalition and other groups focusing on improving the nation's cyber posture sent a letter to the White House warning that the federal leadership vacuum could "hinder the implementation of the National Cyber Strategy and jeopardize the effectiveness of ONCD."

An ONCD official said on Wednesday that the lack of a permanent director did not have “any adverse impact on the business of the office” and added: “It doesn’t seem that the personnel issues of the day are having any impact.” 

A senior White House official also confirmed on Wednesday that the plan will require the federal government to establish an internet of things security labeling program. The effort will be led by the National Security Council and is expected to be completed by the end of the year. 

The plan also aims to shift the burden for mitigating cyber risks from ordinary citizens to the most capable and best-positioned entities, like major software providers and private companies, while increasing incentives to favor long-term investments in cybersecurity. 

In order to further defend the nation's critical infrastructure, the plan requires CISA to lead a process to update the national cyber incident response plan. The plan also tasks CISA and the FBI to collaborate to head off ransomware attacks, including pre-attack planning and incident response resources for high-risk targets like hospitals and school systems. 

Acting National Cyber Director Kemba Walden told reporters on Wednesday that a strategy to address longstanding challenges with the cyber workforce is coming "soon." The strategy pegs the second quarter of fiscal year 2024 as a completion date.

According to Cyberseek — backed by the National Institute of Standards and Technology — there were over 663,000 cybersecurity job openings from May 2022 to April 2023. The same site tags over 8,000 openings at the federal level of the public sector alone.

Walden said the strategy should  "cover short-term needs for cyber workforce, as well as make strategic investments that we need to make in the education system and reskilling and upskilling and digital competency across the spectrum." 

The forthcoming strategy will include a broad focus on the cybersecurity workforce as well as some specifics for the government itself. 

A White House request for comments on cyber workforce policy issued last year generated ideas on increasing diversity in cybersecurity jobs and improving hiring processes. Walden herself, has said that expensive certifications and educational requirements for cybersecurity jobs often block people from entering the field.

"We are working fast and furious," Walden said. "We are rounding the corner on having a completed national workforce and education strategy, which we hope to disclose soon."

Walden also said Thursday, following the release of the implementation, that her office is developing a request for information seeking input on regulatory harmonization around the national cybersecurity strategy.

"We need to hear from our stakeholders about the inconsistent regulations they see and the concerns they have before putting them into action," she said at an event hosted by the Information Technology Industry Council. "We the government and the private sector need to hold each other accountable to meet our shared goals and our shared responsibility for keeping Americans safe online."