Legislation and the future of federal cybersecurity

Shutterstock image: U.S. Capitol reflection in black and white.

Cybersecurity continues to be at the forefront of national focus, thanks to Congress’ passing and the president’s signing of three cybersecurity-related bills last December.

Those statutes are now being implemented to continue the progress agencies have made in protecting government networks and working with state and local agencies, critical infrastructure operators, and other private-sector partners to achieve similar progress.

First, the Federal Information Security Modernization Act of 2014 moves government forward in adapting to the ever-changing landscape of the cyber world. Its importance is evidenced by the increasingly complex vulnerabilities, threats and actions against federal networks, often involving malicious third parties.

The act enables federal agencies to be more effective in developing and implementing protective strategies against network intruders. It continues and updates the risk management framework that has been a core tenet of the Federal Information Security Management Act and encourages agencies to use automated security tools to continuously diagnose and mitigate security vulnerabilities. It also codifies the Department of Homeland Security's role in overseeing the implementation of policy and guidelines for federal civilian agencies.

Concurrently, the National Cybersecurity Protection Act codifies the activities of DHS's National Cybersecurity and Communications Integration Center and further strengthens DHS’s ability to coordinate incident response and provide technical assistance to agencies through a variety of information security tools and techniques.

It authorizes DHS’s existing center to act as a critical interface for sharing cybersecurity information among federal civilian agencies and key stakeholders. The law also includes provisions for:

* Promoting situational awareness to enable real-time, integrated and operational actions across the federal government.

* Sharing cybersecurity threat, vulnerability, impact and incident information and analysis by and among federal, state and local government agencies, and private-sector entities.

* Conducting analysis of cybersecurity risks and incidents.

* Providing recommendations on security and resilience measures to federal and non-federal entities.

* Offering timely technical assistance to federal and non-federal entities with respect to cybersecurity threats and attribution, vulnerability mitigation, and incident response and mitigation.

The act also states that the center shall be composed of federal personnel and representatives from state and local governments and other non-federal entities, including information sharing and analysis organizations and owners and operators of critical information systems.

Finally, the DHS Cybersecurity Workforce Recruitment and Retention Act authorizes actions to enhance the government’s pool of talented cybersecurity professionals. It provides additional authorities to the DHS secretary to assist in the recruitment, training, education, development and retention of a highly qualified federal cybersecurity workforce.

The act also requires the secretary to evaluate efforts to improve the department's cybersecurity workforce and submit an annual report to the appropriate committees of Congress detailing DHS’s progress.

DHS’s continuous diagnostics and mitigation program is a prime example of the government’s efforts to operationalize cybersecurity protection in a way that reinforces the provisions of these three important statutes. Implementation of this and similar programs -- as reinforced by the new laws -- will continue to strengthen the way federal agencies protect their networks, systems and data from ever-evolving threats in cyberspace.

The efforts of the government to build a more effective cybersecurity posture is evident in the implementation of these three cybersecurity bills, which taken together will foster a more effective cybersecurity dynamic. By openly collaborating across agencies, coordinating incident response, and increasing the pool of cybersecurity professionals, the government will grow its capacity to operate in cyberspace at a rapid rate. Cohesive implementation of these bills will enable agencies to mitigate cybersecurity risks and proactively plan for vulnerabilities, providing a fountain for increasingly responsive tactics to address cyber threats successfully.

About the Authors

John Lainhart leads IBM's Public Sector Cybersecurity and Privacy Services.

Dan Chenok is executive director of the IBM Center for the Business of Government.


  • Congress
    Rep. Jim Langevin (D-R.I.) at the Hack the Capitol conference Sept. 20, 2018

    Jim Langevin's view from the Hill

    As chairman of of the Intelligence and Emerging Threats and Capabilities subcommittee of the House Armed Services Committe and a member of the House Homeland Security Committee, Rhode Island Democrat Jim Langevin is one of the most influential voices on cybersecurity in Congress.

  • Comment
    Pilot Class. The author and Barbie Flowers are first row third and second from right, respectively.

    How VA is disrupting tech delivery

    A former Digital Service specialist at the Department of Veterans Affairs explains efforts to transition government from a legacy "project" approach to a more user-centered "product" method.

  • Cloud
    cloud migration

    DHS cloud push comes with complications

    A pressing data center closure schedule and an ensuing scramble to move applications means that some Homeland Security components might need more than one hop to get to the cloud.

Stay Connected


Sign up for our newsletter.

I agree to this site's Privacy Policy.