The Cybersecurity and Infrastructure Security Agency has ordered nearly all federal agencies to rapidly remediate data vulnerabilities within their information systems.
Critical vulnerabilities must be remediated within 15 calendar days of discovery, and high importance vulnerabilities must be resolved within 30 calendar days of initial detection.
The binding operational directive from CISA—an agency organized under the Department of Homeland Security—covers all federal executive branch departments and agencies except for the Department of Defense, Central Intelligence Agency and Office of the Director of National Intelligence.
Also See: Securing data now means improving identity management
The order includes the Department of Health and Human Services, which oversees the nation’s vast healthcare delivery system. CISA will monitor the progress of HHS and other federal agencies and will engage senior leaders, chief information security officers, chief information officers and risk management officials as necessary and appropriate.
Homeland Security will expect agencies to review what are known as cyber hygiene reports, which are…
