Biden signs memo to secure DoD, IC national security systems

WASHINGTON, DC – AUGUST 16: U.S. President Joe Biden delivers remarks on the worsening crisis in Afghanistan from the East Room of the White House August 16, 2021 in Washington, DC. Biden cut his vacation in Camp David short to address the nation as the Taliban have seized control in Afghanistan two weeks before the U.S. is set to complete its troop withdrawal after a costly two-decade war. (Photo by Anna Moneymaker/Getty Images)

Updated Jan. 19, 2021 4:13 p.m. ET with comment from James Lewis, cyber expert at the Center for Strategic and International Studies.

WASHINGTON: President Joe Biden today signed a national security memorandum that establishes guidelines to bolster cybersecurity across the Defense Department and Intelligence Community.

The memorandum builds on Biden’s cybersecurity executive order issued last May on improving cybersecurity across the federal government and sets forth specific guidelines for agencies to adopt zero-trust architecture implementation plans, cloud technologies, multifactor authentication and encryption.

“Within 90 days of the date of this memorandum, the National Manager shall, in coordination with the Director of National Intelligence, the Director of the Central Intelligence Agency, the Director of the Federal Bureau of Investigation, and the heads of appropriate elements of the Department of Defense, develop a framework to coordinate and collaborate on cybersecurity and incident response activities related to [national security systems] commercial cloud technologies that ensures effective information sharing among agencies, the National Manager, and Cloud Service Providers (CSP),” according to the memo.

The memo also designates the National Security Agency with holding other agencies responsible for their security shortcomings. Those agencies are also required to report cyber incidents to the NSA.

Additionally, the memo mandates the chief information officers of DoD and IC agencies to keep an inventory of information systems that “do or should likely” constitute national security systems.

“Agencies shall retain their own inventory subject to access by specified named individuals, or based on specific NSA cyber defense mission roles, and agreed upon between the National Manager and the head of the agency or designee,” the memo states.

James Lewis, a cyber expert at the Center for Strategic and International Studies, told Breaking Defense that while the memorandum makes things “a little more iron-clad,” continuous monitoring will be needed to make sure agencies actually comply with the mandates set forth by Biden.

“NSA now has one set of reporting requirements, [the Department of Homeland Security] has the other,” he said. “What we’ve seen in the past, though, is particularly big, powerful agencies don’t always do what they’re told to do.”

The memorandum directs both the NSA and DHS to share directives between the agencies to see if any requirements should be adopted by the other, according to a White House press release.