The government sector has been notoriously slow to adopt modern cyber security measures. A Netwrix report found that only 14 percent of government organisations believe they are well-prepared to face modern cyber threats. The 2016 US Government Accountability Office report said federal IT systems are becoming increasingly obsolete, with outdated software languages and unsupported hardware.
A new method of accountability
Signed in May 2017, an executive order mandates a new and all-encompassing set of accountability standards by holding agency heads entirely responsible for their agency's security. The order states that executive department and agency heads will be held accountable for cyber security risk management of their enterprises. Executive level officers can no longer pass the blame for a breach onto lower-level IT staff.
Updated standards
All executive departments and agencies must adhere to the NIST Framework for Improving Critical Infrastructure Cybersecurity (the NIST Cybersecurity Framework). Originally created for the private sector, the order extends those guidelines to government agencies. IT vendors may also have to adjust marketing and business models as more stringent guidelines lead to deeper scrutiny of legacy systems.
Shared IT services in the federal sector
The order favours the use of shared IT services such as cloud-based digital platforms. Agency heads were required to submit a full report outlining the feasibility, cost effectiveness and plan of moving to shared IT services. The move mirrors the private sector, where roughly 80 percent of IT budgets were heading to cloud solutions.
Modernising an outdated system
Tougher accountability, updated standards and migration to centralised systems are a step towards preventing and mitigating modern cyber security incidents in federal agencies.
Originally published 16 October 2017. Migrated to the new IRC site in 2026.