Cybersecurity and Infrastructure Security Agency: Actions Needed to Ensure Organizational Changes Result in More Effective Cybersecurity for Our Nation

Until replacements can be made in customers’ installations, Fresenius Kabi recommends users rely on CISA’s recommendations for temporary alternatives. Health care delivery organizations are advised to follow the recommendations published by CISA and Fresenius Kabi to avoid cybersecurity risks that could affect the safety and essential performance of the Fresenius Kabi Agilia Connect Infusion System. Medtronic issued an Urgent Medical Device Correction to inform medical device users of this cybersecurity risk and included actions and recommendations for users to take.

CISA concurred with this recommendation and in September 2021 stated that the agency's human capital office is currently working with to develop a framework for the workforce planning strategy, with the final product aligned to the goals, objectives, and priorities articulated in CISA's strategic planning. Once the agency provides documentation of its actions we plan to verify whether implementation has occurred. CISA concurred with this recommendation and in September 2021 described actions planned and under way to implement it. Specifically, the agency stated that it is developing a draft workplan and timeline to identify metrics and establish an outcome-oriented performance measurement approach. Once complete, CISA stated that this plan will, among other things, gauge the agency's efforts to meet the identified goals of the organizational transformation. CISA plans to complete its effort to identify outcome-oriented performance measures by March 31, 2022.

Within 90 days of the date of this order, the Secretary of Defense, the Director of National Intelligence, and the CNSS shall review the recommendations submitted under subsection of this section and, as appropriate, establish policies that effectuate those recommendations, consistent with applicable law. Within 30 days of the date of this order, the Secretary of Homeland Security acting through the Director of CISA shall provide to the Director of OMB recommendations on options for implementing an EDR initiative, centrally located to support host-level visibility, attribution, and response regarding FCEB Information Systems. The Secretary of Homeland Security, in consultation with the Attorney General and the APNSA, shall review the recommendations provided to the President through the APNSA pursuant to subsection of this section and take steps to implement them as appropriate. The Board shall protect sensitive law enforcement, operational, business, and other confidential information that has been shared with it, consistent with applicable law. The Secretary of Homeland Security shall convene the Board following a significant cyber incident triggering the establishment of a Cyber Unified Coordination Group as provided by section V of PPD-41; at any time as directed by the President acting through the APNSA; or at any time the Secretary of Homeland Security deems necessary. After receiving the recommendations described in subsection of this section, the FAR Council shall review the recommendations and, as appropriate and consistent with applicable law, amend the FAR.

The Federal Government must also carefully examine what occurred during any major cyber incident and apply lessons learned. Protecting our Nation from malicious cyber actors requires the Federal Government to partner with the private sector. The private sector must adapt to the continuously changing threat environment, ensure its products are built and operate securely, and partner with the Federal Government to foster a more secure cyberspace. In the end, the trust we place in our digital infrastructure should be proportional to how trustworthy and transparent that infrastructure is, and to the consequences we will incur if that trust is misplaced.

A state agency’s information security manager, for purposes of these information security duties, shall report directly to the agency head. Establishing the managerial, operational, and technical safeguards for protecting state government data and information technology resources that align with the state agency risk management strategy and that protect the confidentiality, integrity, and availability of information and data. The recovery may include recommended improvements to the agency processes, policies, or guidelines. Completing comprehensive risk assessments and cybersecurity audits, which may be completed by a private sector vendor, and submitting completed assessments and audits to the department. The FBI leads this task force of more than 30 co-located agencies from the Intelligence Community and law enforcement.

Health care delivery organizations should evaluate their network security and protect their hospital systems. CISA is publishing this notice to announce the following CISA Cybersecurity Advisory Committee virtual meeting. If you are using public inspection listings for legal research, you should verify the contents of the documents against a final, official edition of the Federal Register. Only official editions of the Federal Register provide legal notice to the public and judicial notice to the courts under 44 U.S.C. 1503 & 1507.Learn more here.

The Board shall review and assess, with respect to significant cyber incidents (as defined under Presidential Policy Directive 41 of July 26, ) affecting FCEB Information Systems or non-Federal systems, threat activity, vulnerabilities, mitigation activities, and agency responses. It is the policy of my Administration that the prevention, detection, assessment, and remediation of cyber incidents is a top priority and essential to national and economic security. All Federal Information Agency Cybersecurity Systems should meet or exceed the standards and requirements for cybersecurity set forth in and issued pursuant to this order. The Cybersecurity and Infrastructure Security Agency agency has established a website with additional information that the FDA encourages medical device manufacturers to review and follow the identified recommendations to address the vulnerability. Fresenius Kabi also identified that approximatively 1,200 infusion pumps would need hardware changes.

Agencies with cybersecurity vulnerability or incident response procedures that deviate from the playbook may use such procedures only after consulting with the Director of OMB and the APNSA and demonstrating that these procedures meet or exceed the standards proposed in the playbook. Within 30 days of the date of this order, the Secretary of Commerce acting through the Director of NIST shall solicit input from the Federal Government, private sector, academia, and other appropriate actors to identify existing or develop new standards, tools, and best practices for complying with the standards, procedures, or criteria in subsection of this section. The guidelines shall include criteria that can be used to evaluate software security, include criteria to evaluate the security practices of the developers and suppliers themselves, and identify innovative tools or methods to demonstrate conformance with secure practices. The security of software used by the Federal Government is vital to the Federal Government’s ability to perform its critical functions. The development of commercial software often lacks transparency, sufficient focus on the ability of the software to resist attack, and adequate controls to prevent tampering by malicious actors. There is a pressing need to implement more rigorous and predictable mechanisms for ensuring that products function securely, and as intended.