In an era where cyber threats are constantly evolving and becoming more sophisticated, the need for a cohesive and robust cybersecurity strategy across the Federal Civilian Executive Branch (FCEB) has never been more critical. Enter the FCEB Operational Cybersecurity Alignment (FOCAL) Plan, a comprehensive initiative designed to standardize and elevate cybersecurity practices across federal agencies.
What is the FOCAL Plan?
The FOCAL Plan, released by the Cybersecurity and Infrastructure Security Agency (CISA), is a strategic roadmap aimed at aligning cybersecurity efforts across more than 100 FCEB agencies. It recognizes that while individual agencies have unique missions and independently established network architectures, a collective approach to cybersecurity is essential to effectively combat modern threats.
The Five Priority Areas
This plan is organized into five priority areas that CISA considers essential for positioning efforts across the federal cybersecurity landscape and that align with agencies’ Federal Information Security Modernization Act metrics and reporting requirements.
01. Asset Management
Goal: Increase operational visibility
In today’s complex digital landscape, knowing what you have is the first step in protecting it. The FOCAL Plan emphasizes the importance of comprehensive asset management, including:
- Establishing a centralized hardware and software inventory database with automated updates.
- Conducting asset discovery scans at least every seven days.
- Documenting asset coverage and capability gaps.
By achieving full visibility of their digital assets, agencies can better defend against sophisticated attacks and quickly identify risks associated with vulnerable software or hardware.
02. Vulnerability Management
Goal: Manage the attack surface of internet-accessible assets
With an ever-expanding attack surface, agencies must take a proactive approach to vulnerability management. Key actions include:
- Performing regular, full-credentialed vulnerability scanning across all assets.
- Leveraging internal capabilities and CISA advisories for vulnerability prioritization.
- Establishing processes to identify and remediate critical vulnerabilities within mandated timeframes.
This approach aims to shift agencies from a reactive posture to a proactive one, enabling them to address vulnerabilities before they can be exploited.
03. Defensible Architecture
Goals:
- Secure cloud business applications
- Share cybersecurity telemetry with CISA
- Enhance Zero Trust capabilities
A defensible architecture is designed with the understanding that security incidents are inevitable. It focuses on limiting an adversary’s ability to access sensitive data or disrupt operations even after a successful compromise. Key elements include:
- Implementing security configurations for cloud environments.
- Sharing telemetry data with CISA to improve visibility across the federal enterprise.
- Adopting Zero Trust principles, including phishing-resistant Multi-Factor Authentication (MFA) and improved device inventories.
04. Cyber Supply Chain Risk Management (C-SCRM)
Goal: Prepare for rapid removal of high-risk software and hardware
As agencies increasingly rely on external providers and technology, managing supply chain risk becomes crucial. The FOCAL Plan recommends:
- Establishing C-SCRM processes integrated into enterprise governance.
- Developing an agency-wide C-SCRM strategy for informed risk-based decisions.
- Including C-SCRM requirements in procurement and contractual agreements with suppliers.
These measures aim to enhance agencies’ ability to quickly identify and remove high-risk software or hardware from their networks when necessary.
05. Incident Detection and Response
Goals:
- Enable CISA’s persistent access capability
- Advance Security Operations Center (SOC) governance
Even with robust preventive measures, incident detection and response remain critical. The FOCAL Plan emphasizes:
- Ensuring Endpoint Detection and Response (EDR) coverage across agencies.
- Enabling CISA’s persistent access capability for improved situational awareness.
- Integrating Cyber Threat Intelligence (CTI) tools and services.
- Improving data quality and relevance for more effective threat detection and response.
Implementation Strategy
- CISA serves as the operational lead for federal cybersecurity.
- Agencies expected to complete foundational activities for each alignment goal.
- Emphasis on continuous improvement and adaptation to evolving threats.
The FOCAL Plan represents a significant step towards a unified and resilient federal cybersecurity posture. It’s designed to focus resources on actions that substantively advance operational cybersecurity improvements, rather than providing an exhaustive list of tasks.
