This is the fifth in a series of Covington blogs on implementation of Executive Order 14028, “Improving the Nation’s Cybersecurity”, issued by President Biden on May 12, 2021 (the “Cyber EO”).  The first blog summarized the Cyber EO’s key provisions and timelines, and the second, third, and fourth blogs described the actions taken by various federal government agencies to implement the EO during June, July, and August 2021, respectively.  This blog summarizes  key actions taken to implement the Cyber EO during September 2021.

I.   Actions Taken During September 2021 to Modernize Federal Government Cybersecurity

The Office of Management and Budget (OMB) publically released a draft zero trust architecture strategy for federal agencies on September 9, 2021.  On that same day, the Cybersecurity and Infrastructure Agency (CISA) issued two draft documents designed to further OMB’s zero trust strategy: the Zero Trust Maturity Model and the Cloud Security Technical Reference Architecture.  Each of these documents was required by Section 3 of the Cyber EO to modernize and standardize federal government agency approaches to cybersecurity.

The OMB draft zero trust strategy states that the Federal Government can no longer depend on perimeter-based defenses to protect critical systems and data in the current threat environment, and that meeting these threats “will require a major paradigm shift in how Federal agencies approach cybersecurity” — namely, migration to a Zero Trust Architecture.  The draft strategy identifies the “foundational tenet” of  Zero Trust  as “no actor, system, network, or service operating outside or within the perimeter can be trusted.  Instead, we must verify anything and everything attempting to establish access.” The draft states that the purpose of the strategy as “to put all Federal agencies on a common roadmap [to zero trust] by laying out the initial steps agencies must take to enable their journey toward a highly mature zero trust architecture.”

The draft strategy would require agencies to achieve certain specified zero trust security goals by the end of FY2024. These goals are grouped according to five “pillars” underlying the foundation of zero trust.  These pillars are:

  • Identity: Agency staff use an enterprise-wide identity to access the applications they use in their work. Phishing-resistant MFA protects those personnel from sophisticated online attacks.
  • Devices: The Federal Government has a complete inventory of every device it operates and authorizes for Government use, and can detect and respond to incidents on those devices.
  • Networks: Agencies encrypt all DNS requests and HTTP traffic within their environment, and begin segmenting networks around their applications. The Federal government identifies a workable path to encrypting emails in transit.
  • Applications: Agencies treat all applications as internet-connected, routinely subject their applications to rigorous testing, and welcome external vulnerability reports.
  • Data: Agencies are on a clear, shared path to deploy protections that make use of thorough data categorization. Agencies  take advantage of cloud security services to monitor access to their sensitive data, and have implemented enterprise-wide logging and information sharing.

The draft strategy provides considerable detail regarding the goals associated with each of the pillars described above.  In addition, the draft strategy requires each agency to update its zero trust architecture implementation plan to incorporate these requirements and to submit its updated plan to OMB within 60 days after the draft strategy becomes final.

The draft CISA Zero Trust Maturity Model issued on September 9 identifies  three stages of implementation for each of the five foundational “pillars” identified in the draft OMB strategy: “Traditional”; “Advanced”; and “Optimal”.  The model describes each of these stages as follows:

  • Traditional: Manual configurations and assignment of attributes, static security policies, pillar-level solutions with coarse dependencies on external systems, least-function established at provisioning, proprietary and inflexible pillars of policy enforcement, manual incident response and mitigation deployment.
  • Advanced: Some cross-pillar coordination, centralized visibility, centralized identity control, policy enforcement based on cross-pillar inputs and outputs, some incident response to pre-defined mitigations, increased detail in dependencies with external systems, some least-privilege changes based on posture assessments.
  • Optimal: Fully automated assigning of attributes to assets and resources, dynamic policies based on automated/observed triggers, assets have self-enumerated dependencies for dynamic least-privilege access (within thresholds), alignment with open standards for cross-pillar operability, centralized visibility with historian functionality for point-in-time recollection of state.

CISA’s draft maturity model provides considerable additional detail regarding each of the above maturity stages.  It also identifies current and expected services and offerings by CISA that can help an agency reach a higher stage of zero trust maturity.

Finally, CISA’s Cloud Security Technical Reference Architecture provides guidance to federal agencies regarding the advantages and risks of adopting cloud-based services as they move toward zero trust architecture. The Cloud Security Technical Reference Architecture  recommends approaches to cloud migration and data protection for agency data collection and reporting that leverages Cloud Security Posture Management (CSPM). The Architecture document defines CSPM as a continuous process of monitoring a cloud environment; identifying, disclosing, and mitigating cloud vulnerabilities; and improving cloud security.

II.  Actions Taken During September 2021 to Enhance Software Supply Chain Security

The National Institute of Standards and Technology (NIST) held a public workshop on September 14 and 15, 2021, to obtain feedback from government agencies, industry, and other sectors on its draft criteria for pilot labelling programs for (1) consumer software and (2) consumer Internet of Things (IoT) devices required by section 4 of the Cyber EO.  Among the issues discussed at the workshop were whether labelling should be voluntary or mandatory and what methods should be used for conformity assessment and attestation with respect to consumer software and IoT device labels.  A NIST spokesperson stated at the meeting that NIST does not intend to establish its own labelling programs, but rather is focused on developing a baseline for the contents of  consumer software and  IoT labels.  NIST has also stated that it plans to issue a second draft of labelling baseline criteria in October 2021 based on input from the September 14-15 workshop, and  to meet the February 2022 deadline in the Cyber EO for publication of the final baseline.

Print:
Email this postTweet this postLike this postShare this post on LinkedIn
Photo of Robert Huffman Robert Huffman

Bob Huffman represents defense, health care, and other companies in contract matters and in disputes with the federal government and other contractors. He focuses his practice on False Claims Act qui tam investigations and litigation, cybersecurity and supply chain security counseling and compliance…

Bob Huffman represents defense, health care, and other companies in contract matters and in disputes with the federal government and other contractors. He focuses his practice on False Claims Act qui tam investigations and litigation, cybersecurity and supply chain security counseling and compliance, contract claims and disputes, and intellectual property (IP) matters related to U.S. government contracts.

Bob has leading expertise advising companies that are defending against investigations, prosecutions, and civil suits alleging procurement fraud and false claims. He has represented clients in more than a dozen False Claims Act qui tam suits. He also represents clients in connection with parallel criminal proceedings and suspension and debarment.

Bob also regularly counsels clients on government contracting supply chain compliance issues, including cybersecurity, the Buy American Act/Trade Agreements Act (BAA/TAA), and counterfeit parts requirements. He also has extensive experience litigating contract and related issues before the Court of Federal Claims, the Armed Services Board of Contract Appeals, federal district courts, the Federal Circuit, and other federal appellate courts.

In addition, Bob advises government contractors on rules relating to IP, including government patent rights, technical data rights, rights in computer software, and the rules applicable to IP in the acquisition of commercial items and services. He handles IP matters involving government contracts, grants, Cooperative Research and Development Agreements (CRADAs), and Other Transaction Agreements (OTAs).

Read more about Robert HuffmanEmail
Show more Show less
Photo of Susan B. Cassidy Susan B. Cassidy

Ms. Cassidy represents clients in the defense, intelligence, and information technologies sectors.  She works with clients to navigate the complex rules and regulations that govern federal procurement and her practice includes both counseling and litigation components.  Ms. Cassidy conducts internal investigations for government…

Ms. Cassidy represents clients in the defense, intelligence, and information technologies sectors.  She works with clients to navigate the complex rules and regulations that govern federal procurement and her practice includes both counseling and litigation components.  Ms. Cassidy conducts internal investigations for government contractors and represents her clients before the Defense Contract Audit Agency (DCAA), Inspectors General (IG), and the Department of Justice with regard to those investigations.  From 2008 to 2012, Ms. Cassidy served as in-house counsel at Northrop Grumman Corporation, one of the world’s largest defense contractors, supporting both defense and intelligence programs. Previously, Ms. Cassidy held an in-house position with Motorola Inc., leading a team of lawyers supporting sales of commercial communications products and services to US government defense and civilian agencies. Prior to going in-house, Ms. Cassidy was a litigation and government contracts partner in an international law firm headquartered in Washington, DC.

Read more about Susan B. CassidyEmail
Show more Show less
Photo of Ryan Burnette Ryan Burnette

Ryan Burnette advises clients on a range of issues related to government contracting. Mr. Burnette has particular experience with helping companies navigate mergers and acquisitions, FAR and DFARS compliance issues, public policy matters, government investigations, and issues involving government cost accounting and the…

Ryan Burnette advises clients on a range of issues related to government contracting. Mr. Burnette has particular experience with helping companies navigate mergers and acquisitions, FAR and DFARS compliance issues, public policy matters, government investigations, and issues involving government cost accounting and the Cost Accounting Standards.  Prior to joining Covington, Mr. Burnette served in the Office of Federal Procurement Policy in the Executive Office of the President, where he worked on government-wide contracting regulations and administrative actions affecting more than $400 billion dollars’ worth of goods and services each year.

Read more about Ryan BurnetteEmail
Show more Show less
Photo of Nooree Lee Nooree Lee

Nooree is a Special Counsel in Covington’s Government Contracts practice.  He represents government contractors in all aspects of the procurement process and focuses his practice on the regulatory aspects of M&A activity as well as foreign military sales and other international contracting matters.

Read more about Nooree LeeEmailNooree's Linkedin Profile