White House Signs New Cybersecurity Executive Order

by Dentons
Contact

On May 11, 2017, President Donald Trump signed a new Executive Order on cybersecurity entitled Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure. The new order is split up into three sections, and addresses cybersecurity in (1) federal networks, (2) critical infrastructure, and (3) the nation.

Section 1 – Cybersecurity of Federal Networks

Under Section 1, entitled “Cybersecurity of Federal Networks,” the President announced he “will hold heads of executive departments and agencies (agency heads) accountable for managing cybersecurity risk to their enterprises.” Agency heads will be “held accountable by the President for implementing risk management measures commensurate with the risk and magnitude of the harm that would result from unauthorized access, use, disclosure, disruption, modification, or destruction of IT and data.” Agency heads will also be “held accountable by the President for ensuring that cybersecurity risk management processes are aligned with strategic, operational, and budgetary planning processes[.]”

Effectively immediately, every federal agency head must use the Framework for Improving Critical Infrastructure Cybersecurity developed by the National Institute of Standards and Technology (NIST) to manage their agency’s respective cybersecurity risk. Each agency must provide a “risk management report” to the Secretary of Homeland Security and the Director of the Office of Management and Budget (OMB) within 90 days of the new Executive Order. That risk management report must document the risk mitigation and acceptance choices made by each agency head as of May 11, 2017, and must include: (1) the strategic, operational, and budgetary considerations that informed those choices; and (2) any accepted risk, including from unmitigated vulnerabilities. The report must also describe the agency’s action plan to implement the NIST framework.

Once received, the Secretary of Homeland Security and the Director of OMB will jointly assess each agency’s risk management report to determine “whether the risk mitigation and acceptance choices set forth in the reports are appropriate and sufficient to manage the cybersecurity risk to the executive branch enterprise in the aggregate (the determination).” The Director of OMB, in coordination with the Secretary of Homeland Security, and with appropriate support from the Secretary of Commerce and the Administrator of General Services, will then be required, within 60 days of receipt of the agency risk management reports, to submit to the President, through the Assistant to the President for Homeland Security and Counterterrorism, the agency determination and a plan to:

  1. Adequately protect the executive branch enterprise, should the determination identify insufficiencies;
  2. Address immediate unmet budgetary needs necessary to manage risk to the executive branch enterprise;
  3. Establish a regular process for reassessing and, if appropriate, reissuing the determination, and addressing future, recurring unmet budgetary needs necessary to manage risk to the executive branch enterprise;
  4. Clarify, reconcile, and reissue, as necessary and to the extent permitted by law, all policies, standards, and guidelines issued by an agency, and, as necessary and to the extent permitted by law, issue policies, standards, and guidelines in furtherance of this order; and
  5. Align these policies, standards, and guidelines with the NIST Framework.

The Director of the American Technology Council is also directed to coordinate a report to the President from the Secretary of Homeland Security, the Director of OMB, and the Administrator of General Services, in consultation with the Secretary of Commerce, as appropriate, regarding the modernization of the federal IT ecosystem. That report must be completed within 90 days of the new Executive Order and describe the legal, policy, and budgetary considerations “relevant to — as well as the technical feasibility and cost effectiveness, including timelines and milestones, of — transitioning all agencies, or a subset of agencies, to” (1) one or more consolidated network architectures; and (2) shared IT services, including email, cloud, and cybersecurity services.

Section 2 – Cybersecurity of Critical Infrastructure

Under Section 2, entitled “Cybersecurity of Critical Infrastructure,” the White House makes clear it is the “policy of the executive branch to use its authorities and capabilities to support the cybersecurity risk management efforts of the owners and operators of the Nation’s critical infrastructure (as defined in section 5195c(e) of title 42, United States Code)[.]” In carrying out this policy, the new Executive Order identifies five critical areas for focus: (1) supporting critical infrastructure at greatest risk; (2) supporting transparency in the marketplace; (3) resilience against botnets and other automated, distributed threats; (4) assessment of electricity disruption incident response capabilities; and (5) Department of Defense warfighting capabilities and industrial base.

Support to Critical Infrastructure at Greatest Risk

To support critical infrastructure at greatest risk, the Secretary of Homeland Security, in coordination with the Secretary of Defense, the Attorney General, the Director of National Intelligence, the Director of the Federal Bureau of Investigation, the heads of appropriate sector-specific agencies, and all other appropriate agency heads, shall:

  • Identify authorities and capabilities that agencies could employ to support the cybersecurity efforts of critical infrastructure entities to be at greatest risk of attacks that could reasonably result in catastrophic regional or national effects on public health or safety, economic security, or national security;
  • Engage said entities and solicit input as appropriate to evaluate whether and how the authorities and capabilities might be employed to support cybersecurity risk management efforts and any obstacles to doing so;
  • Provide a report to the President, which may be classified in full or in part, through the Assistant to the President for Homeland Security and Counterterrorism, within 180 days of the date of the new Executive Order, that includes: (1) the authorities and capabilities identified in the Executive Order; (2) the results of the engagement and determination as defined in the Executive Order; and (3) findings and recommendations for better supporting the cybersecurity risk management efforts of critical infrastructure entities; and
  • Provide an updated report to the President on an annual basis thereafter.

Supporting Transparency in the Marketplace

To support transparency in the marketplace, the Secretary of Homeland Security, in coordination with the Secretary of Commerce, is required to provide a report to the President, through the Assistant to the President for Homeland Security and Counterterrorism, that “examines the sufficiency of existing Federal policies and practices to promote appropriate market transparency of cybersecurity risk management practices by critical infrastructure entities, with a focus on publicly traded critical infrastructure entities, within 90 days” of the date of the Executive Order.

Resilience Against Botnets and Other Automated, Distributed Threats

The Secretary of Commerce and the Secretary of Homeland Security are required to jointly lead an “open and transparent process to identify and promote action by appropriate stakeholders to improve the resilience of the internet and communications ecosystem and to encourage collaboration with the goal of dramatically reducing threats perpetrated by automated and distributed attacks (e.g., botnets).” The Secretary of Commerce and the Secretary of Homeland Security are also required to consult with the Secretary of Defense, the Attorney General, the Director of the Federal Bureau of Investigation, the heads of sector-specific agencies, the Chairs of the Federal Communications Commission and Federal Trade Commission, other interested agency heads, and appropriate stakeholders in carrying out the Executive Order. Within 240 days of the date of the Executive Order, the Secretary of Commerce and the Secretary of Homeland Security shall also make publicly available a preliminary report on this effort. And within 1 year of the date of the Executive Order, the Secretaries shall submit a final version of the report to the President.

Assessment of Electricity Disruption Incident Response Capabilities

The Secretary of Energy and the Secretary of Homeland Security, in consultation within the Director of National Intelligence, with State, local, tribal, and territorial governments, and with others as appropriate, are required to jointly assess: (1) the potential scope and duration of a prolonged power outage associated with a significant cyber incident against the United States electric subsector; (2) the readiness of the United States to manage the consequences of such an incident; and (3) any gaps or shortcomings in assets or capabilities required to mitigate the consequences of such an incident. The assessment must be provided to the President, through the Assistant to the President for Homeland Security and Counterterrorism, within 90 days of the date of the Executive Order, and may be classified in full or in part.

Department of Defense Warfighting Capabilities and Industrial Base

Within 90 days of the date of the Executive Order, the Secretary of Defense, the Secretary of Homeland Security, and the Director of the Federal Bureau of Investigation, in coordination with the Director of National Intelligence, shall provide a report to the President, through the Assistant to the President for National Security Affairs and the Assistant to the President for Homeland Security and Counterterrorism, on cybersecurity risks facing the defense industrial base, including its supply chain, and United States military platforms, systems, networks, and capabilities, and recommendations for mitigating these risks.

Section 3 – Cybersecurity for the Nation

Section 3 of the Executive Order, entitled “Cybersecurity for the Nation,” provides that it is the policy of the executive branch to promote an “open, interoperable, reliable, and secure internet that fosters efficiency, innovation, communication, and economic prosperity, while respecting privacy and guarding against disruption, fraud, and theft.” This section focuses on: (1) deterrence and protection; (2) international cooperation; and (3) workforce development.

Deterrence and Protection

Within 90 days of the date of the Executive Order, the Secretary of State, the Secretary of Treasury, the Secretary of Defense, the Attorney General, the Secretary of Commerce, the Secretary of Homeland Security, and the United States Trade Representative, in coordination with the Director of National Intelligence, shall jointly submit a report to the President, through the Assistant to the President for National Security Affairs and the Assistant to the President for Homeland Security and Counterterrorism, on the Nation’s strategic options for deterring adversaries and “better protecting the American people from cyber threats.”

International Cooperation

Within 45 days of the date of the Executive Order, the Secretary of State, the Secretary of the Treasury, the Secretary of Defense, the Secretary of Commerce, and the Secretary of Homeland Security, in coordination with the Attorney General and the Director of the Federal Bureau of Investigation, shall submit reports to the President on international cybersecurity priorities, including those concerning investigation, attribution, cyber threat information sharing, response, capacity building, and cooperation. Within 90 days of the submission of those reports, and in coordination with the agency heads, the Secretary of State must provide a report to the President, through the Assistant to the President for Homeland Security and Counterterrorism, documenting an engagement strategy for international cooperation in cybersecurity.

Workforce Development

Commerce and Homeland Security

The Secretary of Commerce and the Secretary of Homeland Security, in consultation with the Secretary of Defense, the Secretary of Labor, the Secretary of Education, the Director of the Office of Personnel Management, and other agencies identified jointly by the Secretary of Commerce and the Secretary of Homeland Security shall:

  • Jointly assess the scope and sufficiency of efforts to educate and train the American cybersecurity workforce of the future, including cybersecurity-related education curricula, training, and apprenticeship programs, from primary through higher education; and
  • Within 120 days of the date of the Executive Order, provide a report to the President, through the Assistant to the President for Homeland Security and Counterterrorism, with findings and recommendations regarding how to support the growth and sustainment of the Nation’s cybersecurity workforce in both the public and private sectors.

Office of National Intelligence

The Director of National Intelligence, in consultation with the heads of other agencies, shall:

  • Review the workforce development efforts of potential foreign cyber peers in order to help identify foreign workforce development practices likely to affect long-term United States cybersecurity competitiveness; and
  • Within 60 days of the date of the Executive Order, provide a report to the President through the Assistant to the President for Homeland Security and Counterterrorism on the findings of the review.

Department of Defense

The Secretary of Defense, in coordination with the Secretary of Commerce, the Secretary of Homeland Security, and the Director of National Intelligence, shall:

  • Assess the scope and sufficiency of United States efforts to ensure that the United States maintains or increases its advantage in national-security-related cyber capabilities; and
  • Within 150 days of the date of the Executive Order, provide a report to the President, through the Assistant to the President for Homeland Security and Counterterrorism, with findings and recommendations on the assessment carried out.

The Dentons Privacy and Cybersecurity Group will continue to monitor the respective agency reports, as they are issued, and examine any additional efforts relating to this new Executive Order and its impact on industry as they develop.

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Dentons | Attorney Advertising

Written by:

Dentons
Contact
more
less

Dentons on:

Readers' Choice 2017
Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
Sign up using*

Already signed up? Log in here

*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
Privacy Policy (Updated: October 8, 2015):
hide

JD Supra provides users with access to its legal industry publishing services (the "Service") through its website (the "Website") as well as through other sources. Our policies with regard to data collection and use of personal information of users of the Service, regardless of the manner in which users access the Service, and visitors to the Website are set forth in this statement ("Policy"). By using the Service, you signify your acceptance of this Policy.

Information Collection and Use by JD Supra

JD Supra collects users' names, companies, titles, e-mail address and industry. JD Supra also tracks the pages that users visit, logs IP addresses and aggregates non-personally identifiable user data and browser type. This data is gathered using cookies and other technologies.

The information and data collected is used to authenticate users and to send notifications relating to the Service, including email alerts to which users have subscribed; to manage the Service and Website, to improve the Service and to customize the user's experience. This information is also provided to the authors of the content to give them insight into their readership and help them to improve their content, so that it is most useful for our users.

JD Supra does not sell, rent or otherwise provide your details to third parties, other than to the authors of the content on JD Supra.

If you prefer not to enable cookies, you may change your browser settings to disable cookies; however, please note that rejecting cookies while visiting the Website may result in certain parts of the Website not operating correctly or as efficiently as if cookies were allowed.

Email Choice/Opt-out

Users who opt in to receive emails may choose to no longer receive e-mail updates and newsletters by selecting the "opt-out of future email" option in the email they receive from JD Supra or in their JD Supra account management screen.

Security

JD Supra takes reasonable precautions to insure that user information is kept private. We restrict access to user information to those individuals who reasonably need access to perform their job functions, such as our third party email service, customer service personnel and technical staff. However, please note that no method of transmitting or storing data is completely secure and we cannot guarantee the security of user information. Unauthorized entry or use, hardware or software failure, and other factors may compromise the security of user information at any time.

If you have reason to believe that your interaction with us is no longer secure, you must immediately notify us of the problem by contacting us at info@jdsupra.com. In the unlikely event that we believe that the security of your user information in our possession or control may have been compromised, we may seek to notify you of that development and, if so, will endeavor to do so as promptly as practicable under the circumstances.

Sharing and Disclosure of Information JD Supra Collects

Except as otherwise described in this privacy statement, JD Supra will not disclose personal information to any third party unless we believe that disclosure is necessary to: (1) comply with applicable laws; (2) respond to governmental inquiries or requests; (3) comply with valid legal process; (4) protect the rights, privacy, safety or property of JD Supra, users of the Service, Website visitors or the public; (5) permit us to pursue available remedies or limit the damages that we may sustain; and (6) enforce our Terms & Conditions of Use.

In the event there is a change in the corporate structure of JD Supra such as, but not limited to, merger, consolidation, sale, liquidation or transfer of substantial assets, JD Supra may, in its sole discretion, transfer, sell or assign information collected on and through the Service to one or more affiliated or unaffiliated third parties.

Links to Other Websites

This Website and the Service may contain links to other websites. The operator of such other websites may collect information about you, including through cookies or other technologies. If you are using the Service through the Website and link to another site, you will leave the Website and this Policy will not apply to your use of and activity on those other sites. We encourage you to read the legal notices posted on those sites, including their privacy policies. We shall have no responsibility or liability for your visitation to, and the data collection and use practices of, such other sites. This Policy applies solely to the information collected in connection with your use of this Website and does not apply to any practices conducted offline or in connection with any other websites.

Changes in Our Privacy Policy

We reserve the right to change this Policy at any time. Please refer to the date at the top of this page to determine when this Policy was last revised. Any changes to our privacy policy will become effective upon posting of the revised policy on the Website. By continuing to use the Service or Website following such changes, you will be deemed to have agreed to such changes. If you do not agree with the terms of this Policy, as it may be amended from time to time, in whole or part, please do not continue using the Service or the Website.

Contacting JD Supra

If you have any questions about this privacy statement, the practices of this site, your dealings with this Web site, or if you would like to change any of the information you have provided to us, please contact us at: info@jdsupra.com.

- hide
*With LinkedIn, you don't need to create a separate login to manage your free JD Supra account, and we can make suggestions based on your needs and interests. We will not post anything on LinkedIn in your name. Or, sign up using your email address.