Biden Orders Fed Cybersecurity Boost; Targets Prevention, Reporting

The Biden administration today issued a long-awaited cyber executive order that compels federal contractors to share information on cyber incidents and establishes a Cybersecurity Safety Review Board, among other measures.

“Today’s executive order makes a down payment towards modernizing our cyber defenses and safeguarding many of the services on which we rely,” a senior administration official said. “It reflects a fundamental shift in our mindset — from incident response to prevention, from talking about security to doing security.”
the EO sets out a series of short-term timelines around several categories:
Removing barriers to sharing threat intelligence
Modernizing federal cybersecurity
Enhancing supply chain security
Establishing a Cyber Safety Review Board
Standardizing the federal government’s “playbook” for replying to incidents
Improving detection on federal networks
Improving the government’s investigative and remediation capabilities
Setting requirements for national security systems
Notably, the EO requires information and communications technology (ICT) service providers with federal contracts to report cyber incidents. “ICT service providers entering into contracts with agencies must promptly report to such agencies when they discover a cyber incident involving a software product or service provided to such agencies or involving a support system for a software product or service provided to such agencies,” the EO states. The EO also requires cyber incident reporting to CISA, in some cases.