June 3, 2024 By Josh Nadeau 3 min read

In March 2023, the U.S. administration released the first National Cybersecurity Strategy Implementation Plan (NCSIP). This was presented as a government action plan consisting of 27 strategic objectives prioritizing critical initiatives to protect national security from ongoing cyber threats.

Recently, 31 initiatives have been added to this plan, and a number of federal agencies have been identified to lead these efforts moving forward.

Goals of the National Cybersecurity Strategy Implementation Plan

The NCSIP outlines several critical implementation actions to improve the U.S. national cybersecurity posture. This effort involves collaboration with various industries and supporting agencies to regulate and enforce new standards in cybersecurity best practices while supporting the development of safer technologies.

The five core pillars established by the NCSIP focus on the following areas:

  1. Defending critical infrastructure by establishing standardized frameworks.
  2. Disrupting threat actors by working with interagency partners and proposing legislation to govern cloud providers.
  3. Encouraging safer software development practices by exploring software liability frameworks.
  4. Adopting network security best practices and promoting memory-safe programming languages.
  5. Expanding international partnerships to establish more flexible foreign assistance mechanisms.

What does the new version of the plan do?

The latest version of the plan, released on May 7, 2024, introduces 31 additional initiatives that have been included and grouped within the five core pillars.

Below are some of the most recent additions:

Initiatives for improving the resilience of critical infrastructure

New initiatives have been added that address actions designed to promote better cybersecurity practices in a range of sectors, including healthcare and water and wastewater services.

In the healthcare sector, the White House will work with the National Institute of Standards and Technology (NIST) to create a Department of Health and Human Services (HHS)-wide strategy to enforce greater accountability in this area.

In the water and wastewater services sector, the U.S. Department of Agriculture will work with the Environmental Protection Agency (EPA) to promote cybersecurity technical assistance, education and training.

Leveraging more collaborations to help avoid large-scale cyberattack campaigns

The second pillar of the NCSIP, focused on “disrupting and dismantling threat actors,” has seen several new additions regarding collaboration to reduce the impact and likelihood of larger cyberattack campaigns.

Implementation timeframes have now been specified for the initial 2023 Department of Defense (DoD) Cyber Strategy that was put in place last year, as well as a renewed focus on collaborating with private-sector entities to improve the speed and utility of cybersecurity efforts.

Ensuring the production of safer digital products

Another part of the NCSIP is designed to put more responsibility on influential digital brands to create more secure products. The plan’s latest version adds a new initiative for the State Department to work with the Joint Ransomware Task Force, the Department of Justice and other U.S. interagency partners to deny ransomware attackers safe havens in foreign countries.

There are also plans to update the National Privacy Research Strategy in collaboration with the Office of Science and Technology Policy (OSTP) to protect the data privacy of individuals when personal data is stored and accessed for large-scale data analytics.

Implementation of the National Cyber Workforce and Education Strategy

A key pillar of the NCSIP is securing next-generation technologies and infrastructure by making smarter investments in cybersecurity training and support.

The new plan introduces the National Cyber Workforce and Education Strategy and calls for reporting on its progress over the next year. This strategy is designed to help develop a playbook to improve cybersecurity workforces and make it easier for workers to enter the field.

Many other initiatives have been added to this latest version of the NCSIP. While deadlines for each initiative vary, most have deadlines stretching through fiscal year 2025, with some initiatives planned for execution by the end of this year.

How will these new initiatives impact the private sector?

The NCSIP is designed to be a dynamic plan with expectations that it should be updated yearly. Version 2 of this plan represents the first annual update and shouldn’t surprise organizations.

Private sector organizations should expect increased collaboration efforts with government agencies as these new initiatives roll out and should keep themselves updated as the deadlines for critical objectives approach.

While many of the new initiatives impact specific industries, there may also be sector-wide impacts that will require all private sector organizations to quickly adapt to the new standards being put in place, with guidance from supporting agencies and industry experts.

More from News

Zero-day exploits underscore rising risks for internet-facing interfaces

3 min read - Recent reports confirm the active exploitation of a critical zero-day vulnerability targeting Palo Alto Networks’ Next-Generation Firewalls (NGFW) management interfaces. While Palo Alto’s swift advisories and mitigation guidance offer a starting point for remediation, the broader implications of such vulnerabilities demand attention from organizations globally.The surge in attacks on internet-facing management interfaces highlights an evolving threat landscape and necessitates rethinking how organizations secure critical assets.Who is exploiting the NGFW zero-day?As of now, little is known about the actors behind the…

Will arresting the National Public Data threat actor make a difference?

3 min read - The arrest of USDoD, the mastermind behind the colossal National Public Data breach, was a victory for law enforcement. It also raises some fundamental questions. Do arrests and takedowns truly deter cyberattacks? Or do they merely mark the end of one criminal’s chapter while others rise to take their place? As authorities continue to crack down on cyber criminals, the arrest of high-profile threat actors like USDoD reveals a deeper, more complex reality about the state of global cyber crime.…

CISA adds Microsoft SharePoint vulnerability to the KEV Catalog

3 min read - In late October, the United States Cybersecurity & Infrastructure Security Agency (CISA) added a new threat to its Known Exploited Vulnerability (KEV) Catalog. Cyber criminals used remote code execution vulnerability in Microsoft SharePoint to gain access to organizations’ networks. The CISA press release states that “these types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.” However, Microsoft identified and released a patch for this vulnerability in July 2024. Cybersecurity experts…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today