Standby: New, Far-Reaching Executive Order on Cybersecurity Expected

Reports are that on Wednesday, November 3, 2021, Jen Easterly, who is the director of Cybersecurity and Infrastructure Security Agency within the Department of Homeland Security, will issue a directive imposing new federal government cybersecurity mandates. Here’s what we know about it:

• The directive, which is intended to move forward some agencies that have been slower in addressing cyber-vulnerabilities, will require federal agencies to patch up to 300 known cybersecurity risks that could result in damaging hacks.
• These risks will be listed in a new federal catalog that will be updated periodically.
• Security flaws listed already in 2021 will require fixes in two weeks with those listed from now on requiring even quicker fixes. Older flaws will have to be fixed in six months.
• The directive will apply to all federal agencies except DoD, the CIA, and the Office of the Director of National Intelligence.
• The directive will also apply to all federal information systems, including those hosted by third parties and federal contractors, and including not just those that are considered critical or high risk.

We will post an update when the directive is published.