This is part of an ongoing series of Covington blogs on implementation of Executive Order 14028, “Improving the Nation’s Cybersecurity,” issued by President Biden on May 12, 2021 (the “Cyber EO”). The first blog summarized the Cyber EO’s key provisions and timelines, and subsequent blogs described the actions taken by various government agencies to implement the Cyber EO from June 2021 through May 2024. This blog describes key actions taken to implement the Cyber EO, as well as the U.S. National Cybersecurity Strategy, during June 2024. It also describes key actions taken during May 2024 to implement President Biden’s Executive Order on Artificial Intelligence (the “AI EO”), particularly its provisions that impact cybersecurity, national security, and software supply chain security.
Office of Management and Budget Releases Report on Agency Cybersecurity Activities Under the Federal Infrastructure Modernization Act
On June 7, the Office of Management and Budget (“OMB”) released an annual report in connection with its obligations under the Federal Information Security Modernization Act of 2014 (“FISMA”). The report highlights the progress that the Administration has made to securing Government under the Cyber EO, including by improving the roll out of endpoint detection and response (“EDR”) and multi-factor authentication (“MFA”) across the Government. The report also highlights the Administration’s efforts to move towards full implementation of zero trust principles across the Government by the end of FY2024. The report assigned a composite score (out of 100) based on an evaluation of agency information security policies and practices of between 90-100 for 12 agencies, of between 80-89 for 7 agencies, and of between 70-79 for 4 agencies. The report also indicates that agencies have largely been successful in meeting the deadlines outlined in the National Cybersecurity Strategy Implementation Plan.
The FedRAMP Program Office Releases Emerging Technology Prioritization Framework
In connection with the directive in Office of Management and Budget Memorandum M-24-10 on agency use of artificial intelligence, in mid-June the FedRAMP program office released a framework for prioritizing emerging technologies, including artificial intelligence, for FedRAMP authorizations. FedRAMP authorizations are generally required for agencies to use cloud services. The process can be lengthy, and in some cases it can be difficult to obtain sponsorship or provisional authorization from the Joint Authorization Board. Under the framework, FedRAMP will generally prioritize generative AI chat interfaces, generative AI code-generation and debugging tools, generative AI prompt-based image generators, and general purpose API offerings that facilitate the integration generative AI capabilities into new or existing systems. There will be three offerings that will be prioritized in each of these categories, which entitles the service provider to move to the front of the line for obtain an authorization.
NIST Issues Draft National Standards Strategy for Critical and Emerging Technology
On June 26, the National Institute of Standards and Technology (“NIST”) released a draft document on leveraging critical and emerging technology (“CET”). The report is centered around four objectives: (1) increase investment, (2) broaden participation, (3) enhance workforce, and (4) sustain integrity and inclusivity.
The report sets forth an implementation roadmap that among other things, recommends that the U.S. Government take immediate action to identify opportunity to increase standards participation; track grants and programs that promote, foster, and remove barriers to U.S. stakeholder participation in international standards activities; and track and evaluating current USG technology cooperation agreements with other governments. On a more long term basis, the report recommends that the U.S. Government:
- “enhance standards coordination across the federal government;
- enhance standards coordination with the private sector;
- enhance standards policy coordination between the USG and foreign governments;
- recognize and incentivize federal agency engagement in standardization;
- provide strong and sustained funding for CET R&D and pre-standardization coordination;
- engage academia as a critical partner in standards development efforts;
- enhance educational efforts in standards;
- develop and sustain communications about standards; and
- remove barriers to participation in standardization.”
Public comments on the report on due on July 12.
FedRAMP issues Guidance on Secure Software Development
On June 28, the FedRAMP program office issued guidance relating to the Secure Software Development Framework. That framework, set forth under Office of Management and Budget memoranda M-22-18 (“Enhancing the Security of the Software Supply Chain through Secure Software Development Practices”) and M-23-16 (“Update to Memorandum M-22-18, Enhancing the Security of the Software Supply Chain through Secure Software Development Practices”), requires agencies to obtain attestations or other assurance from the developers of certain software that the agencies procure and use that the software is developed using secure development practices. The FedRAMP guidance recognizes, consistent with OMB guidance, that cloud service providers participating in the FedRAMP program are subject these requirements and that “critical” software attestations were due by June 8, 2024, whereas all other software attestations are due September 8, 2024.
The guidance also recognizes that agencies are responsible for informing software developers, including cloud service providers such as software-as-a-service providers, whether the software that they are offering is “critical” software. The guidance directs cloud services providers to upload their attestations to these secure development practices to incident response folder in the FedRAMP secure repository in addition to the CISA Repository for Software Attestations and Artifacts. The guidance further directs cloud service providers to email agency customers and the FedRAMP program office to inform them that the forms have been uploaded. If a cloud service provider has not uploaded an attestation form or the results of a third party assessment of its development practices to the appropriate folder, then agencies are required to contact the service provider directly to request it.