Cybersecurity National Action Plan

Cybersecurity National Action Plan
Name	Cybersecurity National Action Plan
Date	2016
Jurisdiction	United States

Contents

Cybersecurity National Action Plan.

The Cybersecurity National Action Plan was a United States federal initiative announced in 2016 to strengthen national cybersecurity posture through federal modernization and public engagement. It combined executive action, legislative proposals, and agency directives to address threats exemplified by incidents such as the Office of Personnel Management data breach and the Sony Pictures hack. The plan influenced policy debates among actors including the White House, the Department of Homeland Security, the National Security Agency, and the Congress of the United States.

Background and Objectives

The plan emerged after high-profile intrusions tied to events like the 2015–2016 cyberattacks on the Democratic National Committee and breaches affecting Federal Emergency Management Agency contractors, prompting responses from officials such as Barack Obama, Sally Yates, and James Clapper (director of National Intelligence). Objectives included modernizing cybersecurity for federal civilian networks overseen by the Office of Management and Budget and the General Services Administration, improving identity management as with recommendations from the National Institute of Standards and Technology, and bolstering public-private cooperation invoked by stakeholders like Microsoft, Amazon (company), and Google. The plan aimed to align with laws such as the Federal Information Security Modernization Act of 2014 and to respond to findings by bodies including the Government Accountability Office and the Congressional Research Service.

Initiatives combined technology, workforce, and consumer protection measures: federal IT modernization levers echoing procurement reforms championed by the Technology Modernization Fund and procurement officials like Mickey Metcalf; adoption of enhanced authentication and encryption practices reflecting NIST Special Publication 800-63 guidance; a focus on breach reporting and incident response protocols akin to standards by the Cybersecurity and Infrastructure Security Agency and the Federal Bureau of Investigation. Consumer-facing components included initiatives for consumer identity protection referenced by consumer advocates such as Senator Elizabeth Warren and industry groups including the Information Technology Industry Council. Workforce development drew on programs associated with the National Science Foundation, the Department of Labor, and academic consortia like Carnegie Mellon University and Massachusetts Institute of Technology to expand cybersecurity education and apprenticeship models. Public awareness campaigns paralleled efforts by nonprofits such as the Electronic Frontier Foundation and the Center for Strategic and International Studies.

Implementation relied on interagency roles anchored at the Executive Office of the President with operational coordination by the Department of Homeland Security and guidance from NIST. Governance structures referenced legacy models from Federal Information Security Management Act implementation and oversight practices used by the Office of Inspector General across agencies such as the Department of Defense and the Department of Veterans Affairs. Operational execution involved federal civilian agencies including the Department of Health and Human Services, the Treasury Department, and the Social Security Administration, with private sector engagement from firms like Cisco Systems, IBM, and Symantec. Congressional oversight and authorization involved committees such as the House Committee on Oversight and Reform and the Senate Committee on Homeland Security and Governmental Affairs.

Funding proposals referenced budgetary mechanisms used in prior initiatives such as the American Recovery and Reinvestment Act of 2009 for IT investment and sought appropriations via the Office of Management and Budget and annual budgets debated in the United States Congress. The establishment of financing vehicles like the Technology Modernization Fund mirrored earlier authorities used by the General Services Administration. Resource allocation prioritized legacy system replacement across agencies including the Department of Veterans Affairs and the Internal Revenue Service, investment in cybersecurity centers at institutions such as University of Maryland, College Park and Georgia Institute of Technology, and grants administered through entities like the National Science Foundation and the Economic Development Administration.

Proponents, including officials from the White House and advocates from Microsoft and Cisco Systems, argued the plan accelerated modernization and workforce growth comparable to historical modernization efforts led by agencies like the National Aeronautics and Space Administration. Critics, including analysts at the Cato Institute, the Heritage Foundation, and reporting by outlets such as The New York Times and The Washington Post, raised concerns about sufficiency of funding, implementation timelines, and reliance on voluntary standards promoted by NIST. Security researchers at institutions like Stanford University and University of California, Berkeley highlighted challenges in measurable outcomes and lingering vulnerabilities illustrated by subsequent incidents involving entities such as Equifax.

The plan acknowledged the transnational nature of threats and implicated multilateral forums including NATO, the United Nations Group of Governmental Experts on Developments in the Field of Information and Telecommunications, and bilateral dialogues with partners like the United Kingdom and Australia. Coordination with international private sector actors such as Microsoft and Google and standards bodies including the Internet Engineering Task Force and the International Organization for Standardization was emphasized. Interagency cooperation built on prior arrangements among the National Security Council, CISA, the National Cybersecurity and Communications Integration Center, and law enforcement partners such as the Federal Bureau of Investigation.

Category:United States cybersecurity policy