WASHINGTON, January 11, 2022 — The executive director of an organization that pushes information technology reform in government testified Tuesday in front of the House Oversight committee that any incident reporting requirements that Congress is considering should not burden officials so much that they end up missing more serious breaches of cybersecurity.
Ross Nodurft of the Alliance for Digital Innovation told lawmakers studying the reform of the Federal Information Security Management Act, a 2002 law which implements an information security and protection program, that the amended legislation should consider keeping Congress abreast of incidents, but should be mindful of how it defines a security problem.
“As Congress considers defining major incidents or codifying vulnerability response policies, any legislation should be mindful of the dynamic nature of responding to cybersecurity challenges facing government networks,” Nodurft said. “If Congress is overly prescriptive in its definition of an incident, it runs the risk of receiving so many notifications that the incidents which are truly severe are missed or effectively drowned out due to thee…
