Cybersecurity and Infrastructure Security Agency

CISA concurred with this recommendation and in September 2021 stated that the agency's human capital office is currently working with to develop a framework for the workforce planning strategy, with the final product aligned to the goals, objectives, and priorities articulated in CISA's strategic planning. Once the agency provides documentation of its actions we plan to verify whether implementation has occurred. CISA concurred with this recommendation and in September 2021 described actions planned and under way to implement it. Specifically, the agency stated that it is developing a draft workplan and timeline to identify metrics and establish an outcome-oriented performance measurement approach. Once complete, CISA stated that this plan will, among other things, gauge the agency's efforts to meet the identified goals of the organizational transformation. CISA plans to complete its effort to identify outcome-oriented performance measures by March 31, 2022.

Log4j is broadly used in a variety of consumer and enterprise services, websites, and applications—as well as medical devices and supporting systems—to log security and performance information. These vulnerabilities may introduce risks for certain medical devices where the device could be made unavailable, or an unauthorized user could remotely impact the safety and effectiveness of device functionality. At this time, the FDA is not aware of any confirmed adverse events affecting medical devices related to these vulnerabilities. Threats to the nation's critical infrastructures and the information technology systems that support them require a concerted effort among federal agencies; state, local, tribal, and territorial governments; and the private sector to ensure their security. The seriousness of the threat was reinforced by the December 2020 discovery of a cyberattack that has had widespread impact on government agencies, critical infrastructures, and private-sector companies. The U.S. Department of Homeland Security released the Cyber Safety Review Board’s first report, which includes 19 actionable recommendations for government and industry.

Health care delivery organizations should evaluate their network security and protect their hospital systems. CISA is publishing this notice to announce the following CISA Cybersecurity Advisory Committee virtual meeting. If you are using public inspection listings for legal research, you should verify the contents of the documents against a final, official edition of the Federal Register. Only official editions of the Federal Register provide legal notice to the public and judicial notice to the courts under 44 U.S.C. 1503 & 1507.Learn more here.

The attempted cyber-attack on a water treatment facility in Florida in early 2021 as well as the Colonial Pipeline ransomware attack were powerful reminders of the substantial risks that need to be addressed. In March 2021, Secretary Mayorkas outlined his broader vision and a roadmap for the Department’s cybersecurity efforts in a virtual address hosted by RSA Conference, in partnership with Hampton University and the Girl Scouts of the USA. On July 12, 2021, the Senate confirmed Jen Easterly by a Voice Vote, directly Agency Cybersecurity after the Senate returned from its July 4th recess. Easterly’s nomination had been reported favorably out of Senate Committee on Homeland Security and Governmental Affairs on June 16, but a floor vote had been reportedly held by Senator Rick Scott over broader national security concerns, until the President or Vice President had visited the southern border with Mexico. Government agencies, allies, industry, academia, and researchers to strengthen cybersecurity awareness to advance the state of cybersecurity.

To do this, we use our unique mix of authorities, capabilities, and partnerships to impose consequences against our cyber adversaries. The cybersecurity vulnerability and incident response procedures currently used to identify, remediate, and recover from vulnerabilities and incidents affecting their systems vary across agencies, hindering the ability of lead agencies to analyze vulnerabilities and incidents more comprehensively across agencies. Standardized response processes ensure a more coordinated and centralized cataloging of incidents and tracking of agencies’ progress toward successful responses. The criteria shall reflect a baseline level of secure practices, and if practicable, shall reflect increasingly comprehensive levels of testing and assessment that a product may have undergone.