Federal Agencies Likely to Get New Cybersecurity Guidance ‘In Coming Weeks’

The Office of Management and Budget is preparing to release new requirements around software supply chain and cybersecurity, according to a top federal cybersecurity official.

While discussing future priorities for federal cybersecurity during a Nextgov event Thursday, Steven Hernandez, chief information security officer for the Education Department and chair of the Federal CISO Council, said a new mandate on software supply chain is forthcoming.

“I wouldn’t be surprised if in the coming weeks we hear something from [the Office of Management and Budget] about what they want to do in the software space, in terms of the next step and building on what [the National Institute for Standards and Technology] put out,” he said.

Pushed to elaborate, Hernandez said policymakers have been working to codify efforts by NIST and other cybersecurity-focused pockets of government like the Cybersecurity and Infrastructure Security Agency, or CISA, to help agencies understand the provenance of software used on government networks and to hold vendors accountable for maintaining security over that code.

“We’re going to see a lot more discussion around software,” Hernandez said. “NIST has done a fantastic job of putting out the first version of the Secure Software Development Framework and I think the next step is going to be the agencies are going to now need to start to execute against that and say, ‘Hey, vendors, you are critical software. We’re going to need you to talk to us and explain how you’re meeting the requirements of the Secure Software Development Framework.”

Agencies are already under mandate from a May 2021 executive order to adhere to the framework, though a forthcoming policy order could give additional guidance and force to that requirement. OMB officials have previously said such guidance should address whether vendors should be allowed to provide the information under self-attestation or be required to submit through third-party verifiers, as with other programs like the Defense Department’s Cybersecurity Maturity Model Certification, or CMMC, and the General Services Administration’s Federal Risk Authorization Management Program, or FedRAMP.

Hernandez also referenced NIST Special Publication 800-161, “Cyber Supply Chain Risk Management Practices for Systems and Organizations,” which sets the standards for ensuring the security of software through the supply chain, including maintaining inventories on the software being deployed on government networks, as well as the provenance of all the code that makes up that software—a practice in the cybersecurity community known as a software bill of materials, or SBOM.

The first update to that document was released Thursday.

“The other side of that coin—equally important and should be right on the heels—is this idea around SBOM and making sure we’re able to get that from our software vendors,” Hernandez said. “And, hopefully, in some type of machine-readable format.”

The machine-readable aspect is not trivial, Hernandez said, as agencies are often short on time and resources when facing a security incident or vulnerability.

“When the next Log4j hits, we want to be able to basically go to our [governance, risk and compliance] tool, run a search and see what has this particular component built into it so that we can immediately start to take action,” he said. “That’s going to be a world of difference from what happened last time, which is I pulled software development teams into my [security operations center] to start looking at different programs to figure out whether they were impacted.”

On a normal day, those teams would be maintaining or building applications to meet Education’s mission, rather than chasing potential security flaws.

Beyond the near-term, Hernandez suggested future executive orders might touch on the cybersecurity implications of quantum computing—to complement a pair of orders on the subject issued this week—and artificial intelligence—which has been the focus of past executive orders, as well.