A House bill that would have put the National Institute of Standards and Technology in charge of auditing agency cybersecurity practices was amended to place that responsibility in the hands of agency inspectors general, a move which a policy expert said will give the bill a better chance of passage.<\/p>\n\n\n\n
\u201cI would think this amendment would increase the likelihood of passage,\u201d said Marcus Christian, partner in the law firm Mayer Brown\u2019s Litigation and Dispute Resolution practice and White Collar Defense and Compliance group. \u201cI think that it\u2019s important to have a capable body conducting these audits.\u201d<\/p>\n\n\n\n
Originally the bill, H.R. 1224, the \u201cNIST Cybersecurity Framework, Assessment, and Auditing Act of 2017,\u201d would have required NIST to conduct audits of agency implementation of the NIST cybersecurity framework.<\/p>\n\n\n\n
According to Rep. Lamar Smith, R-Texas, though NIST has done a great job creating and updating standards within that framework, NIST lacks authority to enforce those standards. And the Office of Management and Budget, which is responsible for assuring federal agency compliance under the Federal Information Security Management Act, lacks the cybersecurity expertise to do so effectively.<\/p>\n\n\n\n
NIST officials have in the past expressed discomfort with their agency moving into the auditing and compliance space, as it could damage the agency\u2019s reputation as an independent standards-setting body.<\/p>\n\n\n\n
Conversely, IGs already conduct audits under FISMA, which Christian said is \u201cnot such a great leap\u201d to the responsibilities outlined in the bill.<\/p>\n\n\n\n
\u201cInspectors general are a better resource for regularly assessing the compliance and sufficiency of federal agencies\u2019 cybersecurity defenses. Under FISMA, the IGs already perform annual audits of all major aspects of agencies\u2019 operations. The IGs also have statutory authority to compel agencies to produce needed information and to comply with indicated improvement and remedial actions,\u201d wrote Smith in the bill\u2019s committee report to Congress. \u201cWhat the IGs lack is crucial internal expertise for assessing cybersecurity issues. H.R. 1224, however, takes advantage of NIST\u2019s singular cybersecurity expertise. As originally reported by the committee, H.R. 1224 would have directed NIST to conduct separate annual cybersecurity audits of federal agencies. After subsequent discussions with the Committee on Oversight and Government Reform, however, agreement was reached on a better approach that is reflected in the legislation to be considered by the full House.\u201d<\/p>\n\n\n\n
The bill now requires NIST to provide guidance for federal agencies to incorporate their Framework for Improving Critical Infrastructure into their information security risk management efforts, as well as establish a working group to create metrics for agencies to assess their risk and write a report on agency adoption rates.<\/p>\n\n\n\n
\u201cNIST won\u2019t be venturing into an area it hasn\u2019t been in the past,\u201d Christian said. \u201cI think this helps NIST to remain in that role.\u201d<\/p>\n\n\n\n
The legislation has been voted favorably out of the House Science, Space and Technology committee and awaits votes on the House floor.<\/p>\n\n\n\n
\u201cThis legislation stems from urgent need. The status quo of U.S. government cybersecurity is demonstrably inadequate and growing worse,\u201d wrote Smith. \u201cThe national and economic security of the United States, and the security of Americans\u2019 personally identifiable information \u2015 held in trust by various federal departments and agencies \u2015 have been threatened by persistent cyberattacks. As the sophistication and frequency of cyberattacks by nation-states and nefarious cyber actors increases, so too does the threat to our economy, critical and virtual infrastructure, and national security.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"
A House bill that would have put the National Institute of Standards and Technology in charge of auditing agency cybersecurity practices was amended to place that responsibility in the hands of agency inspectors general, a move which a policy expert said will give the bill a better chance of passage.<\/p>\n","protected":false},"author":7,"featured_media":30548,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":38,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":{"9":{"categories":["daily-brief","newsletters","home"],"primary_category":""}}},"categories":[38,106,31,33,9,40],"tags":[],"coauthors":[2853],"class_list":["post-10288","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-congress","category-daily-brief","category-home","category-newsletters","category-federal-oversight","category-watchdogs"],"acf":{"subheadline":"","legacy_arc_id":"KGMOJJJSFJACRJB66KAYZFTKPU","arc_canonical_url":"\/federal-oversight\/congress\/2017\/11\/06\/amendment-puts-igs-in-charge-of-cyber-audits-not-nist\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n