Update to national cybersecurity strategy implementation plan coming before the end of summer

The White House will soon release the next steps for the litany of initiatives first released last July, ONCD’s Brian Scott said Tuesday.

MIAMI — Cybersecurity professionals can expect fresh reading materials in the coming months from the Office of the National Cyber Director, which aims to issue an update to the national cybersecurity strategy implementation plan before the summer is over, a White House cyber official said Tuesday.

The implementation plan outlines how the White House will accomplish the goals outlined in the national cybersecurity plan and is supposed to be a “living document” that is updated as initiatives are complete or new initiatives are added. The implementation plan 2.0 is expected “late spring, early summer,” said Brian Scott, deputy assistant national cyber director for cyber policy and programs.

Speaking at the ICS-focused security conference S4x24 in Miami, Scott also noted that cybersecurity pros can expect an update on software liability reform in the next implementation plan release, and the Biden administration is currently looking at developing a framework around software liability. The White House is also convening a symposium of law professors at the end of March around the issue, he said.

“The administration is committed to working with Congress to develop legislative action to incentivize development of software with more secure code,” Scott said.

One aspect of the framework will be exploring how best to implement safe harbor incentives for companies that are developing code using secure methods. Companies that align with those best practices — which are still being explored — are less likely to face legal issues down the road.

“We want to raise the bar here and raise the standards of care to a higher level for the development of software,” Scott said.

Scott also said to expect the next steps on the White House’s goal to achieve regulatory harmonization across the critical infrastructure sectors. The harmonization effort — which is the first initiative in the implementation plan — will try to coalesce the cacophony of regulations and technical standards that critical infrastructure organizations are expected to follow. The idea is to lower the cost of duplicative or conflicting regulations and standards.

ONCD released a request for information last July asking industry and experts to get a scope of the task ahead that will drive some of the ideas. The White House is developing another framework that could harmonize baseline requirements that apply across as many sectors as possible. 

In September, ONCD officials told CyberScoop that the initial idea would not include operational technology as it was considered too bespoke at the time, and instead focus more on IT rules, while noting that they were open to changing that.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

• Election official says Tina Peters would be consultant, won’t have access to election systems