Cybersecurity

A Department of Homeland Security Office of Inspector General audit revealed that 76,000 Customs and Border Protection network users had access to a highly privileged service account, exposing critical gaps in federal identity governance and Zero Trust implementation.

The House-approved continuing resolution temporarily averts the sunset of the Cybersecurity Information Sharing Act of 2015, preserving key liability protections for private sector defense and industry partners sharing threat intelligence with federal agencies through December 11.

The Office of Management and Budget has issued a mandate requiring federal civilian agencies to integrate GSA's Login.gov as the primary single sign-on platform across public-facing websites within two years, while setting strict guidelines for commercial identity vendor offboarding.

The Treasury Department has established a Quantum-Readiness Task Force to transition the financial sector to post-quantum cryptography. The effort aligns critical infrastructure defenses with recent White House mandates to neutralize immediate threat vectors.

House Democrats have called on the Government Accountability Office to investigate how deep workforce cuts at CISA impact federal network defense and critical infrastructure protection. The inquiry comes as CISA grapples with a one-third staffing reduction amid rising state-sponsored cyber threats.

The General Services Administration is overhauling Login.gov with up to 75% price cuts, elevated AI anti-fraud defenses, and a redesigned interface built alongside the National Design Studio.

The Cybersecurity and Infrastructure Security Agency has issued an urgent advisory regarding escalating cyber threats against Programmable Logic Controllers in the Water and Wastewater Systems sector. Threat actors are modifying PLC configurations, driving operational disruptions and forcing manual facility overrides.

CISA has issued comprehensive guidance on open source software security, introducing the C4 Framework for trust assessment across federal agencies and critical infrastructure. The publication outlines core risk management practices for software lifecycles, SBOM integration, and open-source AI systems.

Three C3PAOs report six-month waitlists. The rule delay does not delay the market.

The operational tempo is public. The requirements pull-through is not.