Presidential Executive Order on Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure … Is your report ready?

Presidential Executive Order on Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure … Is your report ready?

May 11, 2017

Section 1 c (ii) of the Presidential Executive Order on Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure, where the Executive Order mandates that the NIST Cybersecurity Framework is the guideline that all Executive Branch agencies should be following:

“Effective immediately, each agency head shall use The Framework for Improving Critical Infrastructure Cybersecurity (the Framework) developed by the National Institute of Standards and Technology, or any successor document, to manage the agency’s cybersecurity risk.  Each agency head shall provide a risk management report to the Secretary of Homeland Security and the Director of the Office of Management and Budget (OMB) within 90 days of the date of this order.  The risk management report shall:

(A)  document the risk mitigation and acceptance choices made by each agency head as of the date of this order, including:

(1)  the strategic, operational, and budgetary considerations that informed those choices; and

(2)  any accepted risk, including from unmitigated vulnerabilities; and

(B)  describe the agency’s action plan to implement the Framework.”

For more on the EO go to https://www.whitehouse.gov/the-press-office/2017/05/11/presidential-executive-order-strengthening-cybersecurity-federal

For more on NIST Compliance, go to https://gttb.com/blog/what-is-nist-compliance/

 

Visibility: Accurately, discover sensitive data; detect and address broken business process, or insider threats including sensitive data breach attempts.

Protection: Automate data protection, breach prevention and incident response both on and off the network; for example, find and quarantine sensitive data within files exposed on user workstations, FileShares and cloud storage.

Notification: Alert and educate users on violations to raise awareness and educate the end user about cybersecurity and corporate policies.

Education: Start target cyber-security training; e.g., identify end-users violating policies and train them.

  • Employees and organizations have knowledge and control of the information leaving the organization, where it is being sent, and where it is being preserved.
  • Ability to allow user classification to give them influence in how the data they produce is controlled, which increases protection and end-user adoption.
  • Control your data across your entire domain in one Central Management Dashboard with Universal policies.
  • Many levels of control together with the ability to warn end-users of possible non-compliant – risky activities, protecting from malicious insiders and human error.
  • Full data discovery collection detects sensitive data anywhere it is stored, and provides strong classification, watermarking, and other controls.
  • Delivers full technical controls on who can copy what data, to what devices, what can be printed, and/or watermarked.
  • Integrate with GRC workflows.
  • Reduce the risk of fines and non-compliance.
  • Protect intellectual property and corporate assets.
  • Ensure compliance within industry, regulatory, and corporate policy.
  • Ability to enforce boundaries and control what types of sensitive information can flow where.
  • Control data flow to third parties and between business units.