June 3, 2024 By Josh Nadeau 3 min read

In March 2023, the U.S. administration released the first National Cybersecurity Strategy Implementation Plan (NCSIP). This was presented as a government action plan consisting of 27 strategic objectives prioritizing critical initiatives to protect national security from ongoing cyber threats.

Recently, 31 initiatives have been added to this plan, and a number of federal agencies have been identified to lead these efforts moving forward.

Goals of the National Cybersecurity Strategy Implementation Plan

The NCSIP outlines several critical implementation actions to improve the U.S. national cybersecurity posture. This effort involves collaboration with various industries and supporting agencies to regulate and enforce new standards in cybersecurity best practices while supporting the development of safer technologies.

The five core pillars established by the NCSIP focus on the following areas:

  1. Defending critical infrastructure by establishing standardized frameworks.
  2. Disrupting threat actors by working with interagency partners and proposing legislation to govern cloud providers.
  3. Encouraging safer software development practices by exploring software liability frameworks.
  4. Adopting network security best practices and promoting memory-safe programming languages.
  5. Expanding international partnerships to establish more flexible foreign assistance mechanisms.

What does the new version of the plan do?

The latest version of the plan, released on May 7, 2024, introduces 31 additional initiatives that have been included and grouped within the five core pillars.

Below are some of the most recent additions:

Initiatives for improving the resilience of critical infrastructure

New initiatives have been added that address actions designed to promote better cybersecurity practices in a range of sectors, including healthcare and water and wastewater services.

In the healthcare sector, the White House will work with the National Institute of Standards and Technology (NIST) to create a Department of Health and Human Services (HHS)-wide strategy to enforce greater accountability in this area.

In the water and wastewater services sector, the U.S. Department of Agriculture will work with the Environmental Protection Agency (EPA) to promote cybersecurity technical assistance, education and training.

Leveraging more collaborations to help avoid large-scale cyberattack campaigns

The second pillar of the NCSIP, focused on “disrupting and dismantling threat actors,” has seen several new additions regarding collaboration to reduce the impact and likelihood of larger cyberattack campaigns.

Implementation timeframes have now been specified for the initial 2023 Department of Defense (DoD) Cyber Strategy that was put in place last year, as well as a renewed focus on collaborating with private-sector entities to improve the speed and utility of cybersecurity efforts.

Ensuring the production of safer digital products

Another part of the NCSIP is designed to put more responsibility on influential digital brands to create more secure products. The plan’s latest version adds a new initiative for the State Department to work with the Joint Ransomware Task Force, the Department of Justice and other U.S. interagency partners to deny ransomware attackers safe havens in foreign countries.

There are also plans to update the National Privacy Research Strategy in collaboration with the Office of Science and Technology Policy (OSTP) to protect the data privacy of individuals when personal data is stored and accessed for large-scale data analytics.

Implementation of the National Cyber Workforce and Education Strategy

A key pillar of the NCSIP is securing next-generation technologies and infrastructure by making smarter investments in cybersecurity training and support.

The new plan introduces the National Cyber Workforce and Education Strategy and calls for reporting on its progress over the next year. This strategy is designed to help develop a playbook to improve cybersecurity workforces and make it easier for workers to enter the field.

Many other initiatives have been added to this latest version of the NCSIP. While deadlines for each initiative vary, most have deadlines stretching through fiscal year 2025, with some initiatives planned for execution by the end of this year.

How will these new initiatives impact the private sector?

The NCSIP is designed to be a dynamic plan with expectations that it should be updated yearly. Version 2 of this plan represents the first annual update and shouldn’t surprise organizations.

Private sector organizations should expect increased collaboration efforts with government agencies as these new initiatives roll out and should keep themselves updated as the deadlines for critical objectives approach.

While many of the new initiatives impact specific industries, there may also be sector-wide impacts that will require all private sector organizations to quickly adapt to the new standards being put in place, with guidance from supporting agencies and industry experts.

More from News

Hackers are increasingly targeting auto dealers

3 min read - Update as of July 11, 2024 In late June, more than 15,000 car dealerships across North America were affected by a cyberattack on CDK Global, which provides software to car dealers. After two cyberattacks over two days, CDK shut down all systems, which caused delays for car buyers and disruptions for the dealerships. Many dealerships went back to manual processes, including handwriting up orders, so that sales could continue at a slower pace. Car buyers who recently bought a car from…

CISA director says banning ransomware payments is off the table

3 min read - The FBI, CISA and NSA all strongly advise against organizations making ransomware payments if they fall victim to ransomware attacks. If so, why not place a ban on paying ransomware demands? The topic came up at a recent Oxford Cyber Forum. Jen Easterly, Director of CISA, commented on the issue, saying, “I think within our system in the U.S. — just from a practical perspective — I don’t see it happening.” It’s unlikely this was a purely spontaneous remark as the…

A proactive cybersecurity policy is not just smart — it’s essential

3 min read - It’s easy to focus on the “after” when it comes to cybersecurity: How to stop an attack after it begins and how to recover when it's over. But while a reactive response sort of worked in the past, it simply is not good enough in today’s world. Not only are attacks more intense and more damaging than ever before, but cyber criminals also use so many different attack methods. Zscaler ThreatLabz 2024 Phishing Report found that phishing attacks increased by…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today