This blog continues Covington’s review of important deadlines and milestones in implementing the Executive Order on Improving the Nations’ Cybersecurity (E.O. 14028, or the “Cyber EO”) issued by President Biden on May 12, 2021.  Previous blogs have discussed developments under the Cyber EO in June 2021 and July 2021.  This blog focuses on developments affecting the EO that occurred during August 2021.

The Cyber EO requires federal agencies to meet several important deadlines in August 2021.  These deadlines are in the areas of enhancing critical software supply chain security, improving the federal government’s investigative and remediation capabilities, and modernizing federal agency approaches to cybersecurity.  In addition, the National Institute of Standards and Technology (“NIST”) took several significant actions related to supply chain security in August 2021, not all of which were driven by deadlines in the Cyber EO.  This blog examines the actions taken by federal agencies to meet the EO’s August deadlines as well as the NIST actions referred to above.

A.  Enhancing Critical Software Supply Chain Security

1. Actions Taken By OMB During August 2021

Section 4(a) of the Cyber EO states that the security and integrity of “critical software” is of particular concern, and that the federal government must take action to rapidly improve the security and integrity of the software supply chain, with a priority on addressing critical software.  Pursuant to section 4(g) of the EO, NIST published a definition of the term “critical software” on June 25, 2021.  Subsequently, on July 8, 2021, NIST published guidance to federal agencies on security measures for critical software.  These developments are discussed in greater detail in our blogs on the June and July 2021 Cyber EO developments.

Section 4(j) of the EO requires the Office of Management and Budget (“OMB”) to take appropriate steps by August 10, 2021 to require that agencies comply with the July 8 critical software security guidance issued by NIST.  On August 10, 2021, Shalanda Young, the Acting Director of OMB, issued a Memorandum to the Heads of Executive Departments and Agencies entitled “Protecting Critical Software Through Enhanced Security Measures” (the “August 10 Memo”).

The August 10 Memo sets out a “phased approach” for agency implementation of the NIST guidance.  During the initial phase, agencies are required to focus on identifying and securing stand-alone, on-premise software that performs “security-critical functions or poses similar significant potential for harm if compromised.”  Such software includes applications that provide the following categories of service:

• identity, credential, and access management (ICAM)
• operating systems, hypervisors, container environments
• web browsers
• endpoint security
• network control
• network protection
• network monitoring and configuration
• operational monitoring and analysis
• remote scanning
• remote access and configuration management
• backup/recovery and remote storage

Along these lines, during the initial phase the August 10 Memo requires each agency to identify by October 10, 2021 all “critical software” as defined by NIST that falls within the categories of service described above that is in use or in the process of acquisition by the agency. The August 10 Memo further provides that each agency must implement the security measures designated in NIST’s July 8 guidance for all categories of critical software included in the initial phase by August 10, 2022.

The August 10 Memo states that OMB will address subsequent phases of implementation in the future for additional categories of software as determined by CISA.  The Memo states that the following categories of software, among others, will be addressed in these future phases:

• software that controls access to data;
• cloud-based and hybrid software;
• software development tools, such as code repository systems, testing software, integration software, packaging software, and deployment software;
• software components in boot-level firmware; and
• software components in operational technology.

2. Actions Taken by NIST During August 2021

The Biden Administration announced at a “Cybersecurity Summit” held at the White House on August 25, 2021 that NIST would collaborate with industry and other partners to develop a new framework for improving the security and integrity of the technology supply chain. The Administration states that this framework will serve as guidance to public and private entities on how to build secure technology and how to assess the security of technology, including open-source software, in their supply chains. This new framework will focus on promoting the development and adoption of international standards.

In a related development, a NIST spokesman announced on August 25, 2021 that NIST will delay issuance of a second draft (update) of SP 800-161 Rev. 1, “Supply Chain Risk Management”, from September 2021 until October or November 2021 in order to incorporate requirements imposed by the Cyber EO.  In particular, Section 4(c) of the EO requires NIST to publish by November 8, 2021 preliminary guidelines for enhancing software supply chain security based on input from federal agencies, private industry, and academia that NIST received in June and July 2021. The NIST spokesperson stated that delaying the issuance of the NIST SP 800-161 Rev. 1 update would allow the agency to meet the EO’s November 8 deadline for preliminary guidance on enhancing software supply chain security.  It is unclear whether the update to SP 800-161 is the same as the new NIST framework for improving the security and integrity of the technology supply chain that the Biden Administration announced at the White House Cybersecurity Summit.

On August 24, 2021, NIST released the final version of NISTIR 8259B, “IOT Non-Technical Supporting Capability Core Baseline“.  This document complements NISTIR 8259A, “Core Device Cybersecurity Capability Baseline (May 2020), which is NIST’s guide to the technical aspects of manufacturing secure Internet of Things (“IOT”) devices and products.  The document describes four recommended non-technical supporting capabilities related to the lifecycle of cybersecurity management that manufacturers should implement, including (1) documentation, (2) information and query reception, (3) information dissemination, and (4) education and awareness.  Together, NISTIR 8259A and NISTIR 8259B are intended to define a baseline set of activities that manufacturers should undertake during the planning, development, and operational life of IOT devices to address the cybersecurity needs and goals of their customers.

On August 31, NIST issued a draft White Paper setting forth criteria that can be used to create the pilot labelling program for consumer IOT devices contemplated by Section 4 of the Cyber EO.  This program is intended to educate the public on the security capabilities and vulnerabilities of IOT devices and software development practices.  The White Paper notes among other things that in line with the direction set forth by the Cyber EO, IoT products must reflect increasingly comprehensive levels of testing and assessment, and that “[m]ore cybersecurity controls may be needed for devices that pose inherently greater risks such as a door lock or stove.”  The White Paper notes that a label should clearly convey information to consumers about elevated security capabilities, and that it should be understandable and actionable by the consumer.  The White Paper states that NIST plans to hold a workshop on September 14 and 15, 2021, to obtain comments and other input on the pilot labelling program.

B.  Improving the Federal Government’s Cyber Investigative and Remediation Capabilities

Section 8(c) of the Cyber EO requires OMB, in consultation with the Secretaries of Commerce and DHS, to formulate policies for agencies to establish requirements for logging, log retention, and log management that ensure centralized access and visibility for the highest level security operations center (“SOC”) of each agency.  On August 27, 2021, the OMB Director issued a Memorandum to the heads of federal agencies regarding the logging, log retention, and log management requirements of EO section 8(c) (the “August 27 Memo”).  The August 27 Memo also establishes requirements for agencies to increase the sharing of such information, as needed and appropriate, to accelerate incident response efforts and to enable more effective defense of federal information and agencies.

Section 1 of the August 27 Memo establishes an “Event Logging (“EL”) maturity model that includes the four “Logging Tiers” described in the following table:

The August 27 Memo requires each federal agency to assess its current logging maturity against the four tiers in the Memo’s maturity model and identify any resource and implementation gaps that may exist relative to the respective requirements of each of  those tiers. Agencies are required to report their assessments and gap analyses to OMB by October 27, 2021. In addition, the August 27 Memo requires each agency to reach the EL Tier 1 Maturity level by August 27, 2022, the EL Tier 2 Maturity level by February 27, 2023, and the EL Tier 3 Maturity level by August 27, 2023.

C.  Modernizing Federal Agency Approaches To Cybersecurity

Section 3(c) of the Cyber EO states that federal agencies should migrate to cloud technology in a coordinated, deliberate way that adopts Zero Trust Architecture as practicable.  The EO directs CISA to modernize its current cybersecurity programs, services, and capabilities to be fully functional with cloud-computing environments that have Zero Trust Architecture.  The EO also directs CISA, in consultation with the GSA’s FedRAMP Program, to develop security principles governing Cloud Service Providers (“CSPs”) for incorporation into agency modernization efforts.

To implement these requirements, Section 3(c) imposes an August 10, 2021 deadline for completion of the following:

• OMB’s development of a Federal cloud-security strategy and its issuance of guidance to agencies that seeks to ensure that they fully understand and effectively address the risks of using cloud-based services and to move them closer to Zero Trust Architecture.
• CISA’s issuance of cloud-security technical reference architecture documentation for civilian agencies that illustrates recommended approaches to cloud migration and data protection for agency data collection and reporting.
• Evaluation by each federal agency of the types and sensitivity of its unclassified data that includes appropriate processing and storage solutions for such data, with priority on identifying that data that is most sensitive and under the greatest threat.

It is unclear what, if any, actions were taken by OMB, CISA, or federal agencies to implement these requirements during August 2021.