Cybersecurity: Federal Policy, Critical Infrastructure Protection, and Incident Response

This report examines federal cybersecurity policy, including the Cybersecurity and Infrastructure Security Agency's (CISA) role in protecting critical infrastructure, the Federal Information Security Modernization Act (FISMA), and cyber incident reporting requirements under the Cyber Incident Reporting for Critical Infrastructure Act.

The report discusses the National Cybersecurity Strategy and its implementation plan, including efforts to shift cybersecurity responsibility to technology providers, strengthen federal network defenses, and combat ransomware. It analyzes recent major cyber incidents and federal response activities.

Congressional considerations include proposals to enhance federal cybersecurity workforce development, regulate the security of Internet of Things devices, establish cybersecurity standards for critical infrastructure sectors, and address the use of artificial intelligence in both offensive and defensive cyber operations.