House Science Backs Cyber EO, Highlights Federal Failures

management audit is “truly alarming,” said Investigations Subcommittee ranking member Jay Obernolte, R-Calif. More than half the 23 agencies analyzed didn’t implement basic best practices, he noted, saying this points to a failure of governance. Subcommittee Chairman Bill Foster, D-Ill., questioned whether agencies are doing enough to enforce best practices. The EO calls for bold action, he said. It's a “sea change” in how the federal government approaches cybersecurity, said Research and Technology Subcommittee Chairwoman Haley Stevens, D-Mich. She highlighted the National Institute of Standards and Technology’s role. Research and Technology Subcommittee ranking member Michael Waltz, R-Fla., called the EO a good starting point, saying there’s much work ahead. The auditor report really is “alarming” and shows foundational practices and guidance aren’t being followed, he said. NIST is committed to develop standards, best practices and key guidance for securing critical software, said Information Technology Laboratory Computer Security Division Chief Matthew Scholl. GAO is examining unknowns about the SolarWinds cyberattack, which had unprecedented sophistication, said GAO Information Technology and Cybersecurity Director Vijay D’Souza: The attack wasn’t surprising given findings in December's study.