The FISMA Focus IPD

From: FCW

By Amber Corrin

It has been less than six months since President Obama issued an executive order targeting cybersecurity in U.S. critical infrastructure, a mandate that has pushed federal agencies and privately owned utilities into security overdrive. The first and second sets of deliverables, now in after respective June and July deadlines, mean agencies are now at the point to reasonably ask: Can the government actually get this done?

The cyber EO and its push to secure critical infrastructure – power companies, water utilities and the like – demand an unusual level of cooperation between the government and industry. The first deliverables, due 120 days after the EO’s release, center on information-sharing, figuring out incentives and expanding existing critical infrastructure protections. The 150-day deliverables take matters a step further by zeroing in on the parts of critical infrastructure most vulnerable to catastrophic incidents, and evaluating and improving the truly crucial public-private partnerships.

With the second set of deliverables submitted on July 12, officials say the intense work in both sectors has highlighted all the pieces that are coming together – and the parts of the puzzle that still need more work. At the crux of it all is a tension between missions, requirements and approaches.

“Looking at [how] over the last 10 years we’ve been building this partnership – what’s worked, what hasn’t — overall we’ve found that the structure has worked well,” said Jeanette Manfra, deputy director of the Homeland Security Department’s cyber EO integrated task force. “We need to do a better job in the areas of flexibility; you can’t treat all the sectors the same, or even a sector itself as all the same. So it’s flexibility, and it’s also the ability to balance the empowerment and accountability pieces that need to be in there.”

Read Complete Article