Federal agencies face complex cyber compliance – but relief is underway

In the face of escalating cyber threats to our critical infrastructure, economy, and way of life, federal agencies are continuously releasing mandates, memos, requirements, and executive orders focused on improving cyber hygiene. This creates a heavy, ever-shifting compliance burden for these agencies, as well as the many private companies, especially those in the critical sectors, that tend to rely on these agencies’ requirements in enhancing their own cyber strategies.

The White House has taken note, and in July 2023 released a harmonized National Cybersecurity Strategy Implementation Plan.

Among its initiatives, the strategy broadly mentions the need to drive key cybersecurity standards. A few days after the strategy’s release, the Office of the National Cyber Director (ONCD) issued a Request for Information (RFI) seeking input from stakeholders in order to “understand existing challenges with regulatory overlap and inconsistency in order to explore a framework for reciprocal recognition by regulators of compliance with common baseline cybersecurity requirements.”

“When cybersecurity regulations of the same underlying technology are inconsistent or contradictory – or where they are duplicative but enforced differently by different regulators – consumers pay more, and our national security suffers,” ONCD wrote.

CohnReznick expects the final output will create a baseline standard for federal agencies, instead of the multiple and disparate standards they currently must comply with. Additionally:

• There will be a standardized cybersecurity rule for incident reporting and multifactor authentication.
• High-risk operators in the Transportation sector would be required to have a standardized vulnerability assessment procedure in place.
• Cloud Service Providers (CSPs) such as AWS, Microsoft Azure, Google Cloud Platform, and Oracle may be designated as “critical infrastructure.”

However, the White House is careful that it is not “over-regulating” the cybersecurity industry. To that end, Robert Knake, former acting principal deputy national cyber director, said that the national strategy does not seek to iron out “conflicting rules or even conflicting regulators,” but rather to devise a process for “reciprocity,” which would allow organizations to meet multiple requirements with a minimal number of assessments.

Both the Cybersecurity and Infrastructure Security Agency (CISA) and the National Institute of Standards and Technology (NIST) will continue to play key roles in the new national cybersecurity strategy implementation plan.

The White House is fully aware the national cybersecurity strategy can quickly become obsolete as cyber criminals devise new methods to outwit defenses. Hence, the strategy will be a living document, and will undergo updates when necessary.