Comprehensive_IT_Governance_Document_for_Acquisition_V2.1.pdf

1 | P a g e

Transportation Security Administration (TSA)

Comprehensive Cybersecurity, Information Assurance, Privacy Requirements and Specifications for Outcome-

Based Production Solutions and Vendor/Private Partnership

Solutions as well as Sandbox and/or Demonstrations

Mandatory Federal Acquisition Package for Enterprise IT, Cloud, and Emerging SI Technologies — Incorporating

Outcome-Based 'Try-Before-You-Buy' Sandbox Operational Demonstrations

Document Type: Section C (PWS/SOO), Section H, Section L (Instructions), Section

M, and Attachment J

Acquisition Strategy: Outcome-Based Phased Down-Select via 100% Vendor-Funded

Sandbox Demonstration

Statutory Baselines: FISMA 2014, NIST SP 800.37 Rev 2, NIST SP 800-53 Rev. 5.2, NIST SP 800-160 Vol. 1 Rev 1, NIST SP 800-160 Vol. 2 Rev 1, NIST

AI 100-1 (AI RMF 1.0), NIST AI 100-2 (Adversarial ML), NIST SP

800-53 B, NIST SP 800-82 Rev. 3, FIPS 199, FedRAMP, DHS CDM, CISA Zero Trust Architecture, DISA STIGs/SRGs, Prohibited End-of-

Life and End-of-Support Technologies, DHS Deprecated Protocols, TSA Approved Operating Systems, OMB A-130, OMB M-26-14, OMB M-22-09, OMB M-22-18, OMB M-25-21, OMB M24-18, EO

14028, EO 2023, EO 2025

Applicable Technology: Enterprise IT, Cloud Platforms (FedRAMP), Custom Software, SI/ML, Autonomous Agents

Issuing Authority: Office of the Chief Information Officer (OCIO) / Information

Assurance Division

1.0 PURPOSE, SCOPE, AND OUTCOME-BASED ACQUISITION

STRATEGY

The purpose of these Cybersecurity and privacy requirements is to document the mandatory Transportation Security

Administration’s (TSA) minimum TSA Enterprise Cybersecurity super intelligence (SI), data governance, secure software and development security operations (DEVSECOPS) and risk management based Cyber requirements for

Fiscal Year (FY) 2027. Meeting the minimum does not guarantee immediate Approval to Operate (ATO), but not meeting the minimum Cybersecurity requirements shows the system “as is” is not ready for an ATO and will be required to undergo additional system hardening and security control configurations.

The overarching objective is to safeguard federal information systems, assets, data/information, sensitive operational workflows, (secure)/personally identifiable information (sPII & -PII), Sensitive Security Information (SSI), as well as For Official Use Only (FOUO and Controlled Unclassified Information (CUI) data and national security-adjacent data assets against compromise to include unauthorized access, exfiltration, data manipulation or deletion, algorithmic compromise, adversarial manipulation, or operational disruption across the entirety of the system development life cycle (SDLC).

Outcome-Based 'Try-Before-You-Buy' Paradigm: Traditional federal IT procurements rely heavily on written proposals and written/documented “promises” that frequently fail to materialize during operational deployment.

Under this procurement procedure, the Agency operationalizes an Outcome-Based 'Try-Before-You-Buy'

2 | P a g e

Acquisition Framework. The technical evaluation shifts 100% of the financial and technical, and Cybersecurity risks onto offerors by requiring a mandatory, live operational demonstration of their proposed capability within a dedicated, vendor-funded sandbox enclave prior to contract award or operational cutover. The following

Information Assurance and Cybersecurity and privacy requirements are needed if any public based TSA data is to be used in a “Sandbox” or demonstration environment in a production environment and/or for a formal initial Authority to Operate (ATO) or Authority to Use (ATU) under the Department of Homeland Security (DHS) 4300A and TSA

Information Technology and Operational Technology (IT & OT) and Cloud security handbooks and policies. These requirements are mandatory if used in an airport or for vetting or processing the public at large as a demonstration or not.

CRITICAL MANDATE: VENDOR-FUNDED RISK ALLOCATION

The Offeror shall establish, configure, host, secure, and maintain the demonstration sandbox environment ENTIRELY AT

THE OFFEROR'S OWN EXPENSE. The Federal Government shall assume ZERO financial liability, operational cost, cloud compute fees, software licensing charges, or administrative overhead associated with establishing or executing the sandbox demonstration. Participation in the demonstration is non-compensable and conducted at the vendor's sole risk under FAR Part

15 and FAR Part 12 commercial procedures.

Figure 1: Outcome-Based Vendor-Funded Sandbox Demonstration & Down-Select Acquisition Framework

1.1 Statutory, Regulatory, and Cybersecurity and Privacy OMB Memorandums, Executive

Orders and Policies Baseline Framework and Requirements

The Contractor’s solution shall fully comply with and operationally implement the latest iterations of the following authorities, see Appendix 1 for details of each):

● FISMA 2014 (Public Law S.252)1 - Federal Information Security Modernization Act of 2014 (FISMA):

The Federal Information Security Modernization Act (FISMA) is a United States law that requires federal agencies and third-party contractors to build and maintain programs that protect government information and systems/assets.

● National Institute of Standards and Technology (NIST) RMF SP 800.37 Rev 2 “Risk Management

Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and

Privacy”, is a federal publication that provides a structured, flexible process for integrating security and privacy risk management into the system development life cycle. Published in December 2018.

● NIST RMF SP 800.37 Rev 2 “Risk Management Framework for Information Systems and

Organizations”: A System Life Cycle Approach for Security and Privacy”, is a federal publication that provides a structured, flexible process for integrating security and privacy risk management into the system development life cycle. Published in December 2018.

3 | P a g e

● NIST SP 800.53 Rev 5.2, “Security and Privacy Controls for Information Systems and Organizations “:

Was issued (last updated) on August 27, 2025, to improve the security and reliability of software updates and patches for the 20 Information Assurance (IA) Security Controls needed to be implemented in response to

Executive Order 14306 (Sustaining Select Efforts to Strengthen the Nation’s Cybersecurity. Executive Order

14306 is a presidential directive signed by President Donald Trump on June 6, 2025, that scales back federal

Cybersecurity mandates and shifts cyber policy toward industry-led standards.

● NIST SP 800-160 Vol. 1 Rev. 1 Engineering Trustworthy Secure Systems: This publication describes a basis for establishing principles, concepts, activities, and tasks for engineering trustworthy secure systems. Such principles, concepts, activities, and tasks can be effectively applied within systems engineering efforts to foster a common mindset to deliver security for any system, regardless of the system’s purpose, type, scope, size, complexity, or the stage of its system life cycle. The intent of this publication is to advance systems engineering in developing trustworthy systems for contested operational environments (generally referred to as systems security engineering) and to serve as a basis for developing educational and training programs, professional certifications, and other assessment criteria.

● NIST SP 800-160 Vol. 2 Rev. 1 Developing Cyber-Resilient Systems: A Systems Security Engineering

Approach: NIST Special Publication (SP) 800-160, Volume 2, focuses on cyber resiliency engineering—an emerging specialty systems engineering discipline applied in conjunction with systems security engineering and resilience engineering to develop survivable, trustworthy secure systems. Cyber resiliency engineering intends to architect, design, develop, implement, maintain, and sustain the trustworthiness of systems with the capability to anticipate, withstand, recover from, and adapt to adverse conditions, stresses, attacks, or compromises that use or are enabled by cyber resources. From a risk management perspective, cyber resiliency is intended to help reduce the mission, business, organizational, enterprise, or sector risk of depending on cyber resources.

● NIST AI 100-1 (AI RMF 1.0): Released in January 2023, this is a voluntary, non-sector-specific framework designed to help organizations manage AI risks and promote trustworthy and responsible AI development

● NIST AI 100-2 (Adversarial ML): Published as AI 100-2 E2023 and updated with AI 100-2 E2025, this document establishes a standardized taxonomy, terminology, and mitigation strategies for adversarial attacks on machine learning systems

● NIST SP 800-53B Control Baselines for Information Systems and Organizations: This publication provides security and privacy control baselines for the Federal Government. There are three security control baselines

(one for each system impact level—low-impact, moderate-impact, and high-impact), as well as a privacy baseline that is applied to systems irrespective of impact level. In addition to the control baselines, this publication provides tailoring guidance and a set of working assumptions that help guide and inform the control selection process. Finally, this publication provides guidance on the development of overlays to facilitate control baseline customization for specific communities of interest, technologies, and environments of operation.

● NIST SP 800-82 Rev. 3 Guide to Operational Technology (OT) Security: This document provides guidance on how to secure operational technology (OT) while addressing their unique performance, reliability, and safety requirements. OT encompasses a broad range of programmable systems and devices that interact with the physical environment (or manage devices that interact with the physical environment). These systems and devices detect or cause a direct change through the monitoring and/or control of devices, processes, and events.

Examples include industrial control systems, building automation systems, transportation systems, physical access control systems, physical environment monitoring systems, and physical environment measurement systems. The document provides an overview of OT and typical system topologies, identifies common threats and vulnerabilities to these systems, and provides recommended security countermeasures to mitigate the associated risks.

● FIPS 199 (HMH): Which is the Federal Information Processing Standards Publication: Standards for Security

Categorization of Federal Information (Data) and Information Systems (IT and OT) for Confidentiality, Integrity, Availability impact levels of High, Moderate or Low for each.

4 | P a g e

● FedRAMP (Public Law 117-263): Federal Risk and Authorization Management Program (FedRAMP):

Enacted into law on December 23, 2022, as part of Public Law 117-263 (the James M. Inhofe National Defense

Authorization Act for Fiscal Year 2023), which is the United States government-wide program that standardizes

Cybersecurity assessment, authorization, and continuous monitoring for cloud products and services. This sets what the requirements are that all cloud services (Information as a Service (IaaS), Platform as a Service (PaaS), Software as a Service (SaaS), Servicer-less, Lambda, etc.) for TSA must use FedRAMP Gov Cloud - authorized government-approved cloud (Gov Cloud) environments at the appropriate impact level, as defined in the TSA

Cloud Security Handbook. Cloud environments must meet applicable federal, DHS, and TSA security requirements, align with Zero Trust principles and maintain authorization status, and support continuous monitoring, logging, incident reporting, and data protection obligations.

● Continuous Diagnostics and Mitigation (CDM): Which is a U.S. federal program developed in 2012 by the

Department of Homeland Security (DHS) and managed by the Cybersecurity and Infrastructure Security

Agency (CISA) to provide risk-based, cost-effective Cybersecurity solutions for government networks and systems.

● Cybersecurity and Infrastructure Security Agency (CISA) Zero Trust Maturity Model 2.0 which has Five

Pillars: Vendors and contractors must align and support TSA’s adoption of Zero Trust principles in alignment with the CISA Zero Trust Maturity Model 2.0. Solutions and services should advance identity, device, network, application workload, and data security and encryption maturity through strong authentication, least privilege access, continuous monitoring, segmentation, encryption, and risk-based access controls.

● Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs) and

Security Recommendation Guides (SRGs) https://www.cyber.mil/stigs/: The Security Technical

Implementation Guides and Security Requirements Guides for the Department of Defense and Homeland

Security (DOD & DHS) information technology systems as mandated by DODI 8500.01 and DHS 4300A. This guidance bridges the gap between the National Institute of Standards and Technology Special Publication 800-

53 and risk management framework (RMF).

● Prohibited End-of-Life and End-of-Support Technologies: Vendors and contractors shall not deploy, operate, or maintain any end-of-life and/or end-of-support hardware, software, operating systems, applications, libraries, firmware, or other Information Technologies (IT), Operational Technologies (OT) or any other technologies in support of TSA systems and/or services. All technologies must remain Original Equipment

Manufacturer (OEM) or vendor-supported, be in a state to be able to receive and install (with testing) security updates and be upgraded or replaced before support expiration.

● Eliminate Deprecated Protocols: Vendors and contractors shall not use deprecated, insecure, or unauthorized protocols within TSA environments or systems that connect to or support TSA operations. Any identified deprecated protocols must be reported, remediated, or replaced with approved secure alternatives in accordance with DHS and TSA requirements. These include but are not limited to http, telnet, ftp, tftp, NTLM, SSL and

TLS below 2.0 (see full list in Appendix 1 below)

● TSA Approved Operating Systems (OSes): Vendors and contractors shall ensure that all systems, devices, platforms, and solutions used to support TSA operate on TSA-approved operating systems. Operating systems must be actively supported, securely configured, patched in accordance with required timelines, and aligned with TSA security baselines and configuration standards. These include but are not limited to Windows

Workstation Enterprise 11 24H2, Windows Server 2022, Red Hat Linux, Apple iOS 26.7 (see full list in

Appendix 1 below)

● OMB Circular A-130: This is an official policy directive from the U.S. Office of Management and Budget

(OMB) titled "Managing Information as a Strategic Resource". It guides federal agencies on how to plan, budget, govern, and manage federal information and technology resources.

● OMB M-21-31 (replaced by M-24.16), M-22-09, M-22-18, M-23-16, M-24-10 (replaced by M-25-21), M-

24-18: Are policy memoranda issued by the United States Office of Management and Budget (OMB) to direct federal agencies on cybersecurity, zero-trust architecture, and artificial intelligence governance.

● Executive Orders 14028 (parts rescinded), 14306, 2023 and 2025: A Presidential Executive Order (EO) is

5 | P a g e

2.0 SUPER INTELLIGENCE (SI) AND EMERGING TECH

GOVERNANCE

Where the proposed solution incorporates Super Intelligence (SI), Machine Learning (ML), Large Language Models

(LLMs), Generative SI (GenSI), automated cognitive agents, or algorithmic decision-support logic, the Contractor must implement stringent guardrails in strict compliance with EO 2023 and 2025, OMB M-24-10, and the NIST

Artificial Intelligence Risk Management Framework (NIST AI RMF 1.0 / NIST AI 100-1).

Figure 3: Mandatory Federal AI & Secure Software Development Lifecycle Assurance Pipeline

2.1 Categorization and Impact Assessment

The Contractor shall conduct a mandatory pre-acquisition evaluation against the definitions established in OMB M-

24-10 to determine whether the proposed capability constitutes a 'rights-impacting' or 'safety-impacting' artificial intelligence application. If categorized as such, the Contractor shall establish mandatory operational risk mitigations—including external civil rights reviews, bias benchmarks, and automated human-in-the-loop fallback mechanisms—prior to ingesting or processing operational agency data.

2.2 Model Isolation and Prohibition on Agency Data Ingestion

CRITICAL MANDATE: ABSOLUTE DATA ISOLATION CLAUSE

The Contractor covenants and guarantees that federal data, queries, prompts, conversational context, metadata, vector representations, and derived outputs shall NEVER be ingested, aggregated, analyzed, or utilized by the

Contractor, its subcontractors, or third-party foundational model providers to train, fine-tune, retrain, benchmark, or align public, commercial, or multi-tenant foundational models. All fine-tuning weights and RAG vector indices generated using agency data shall remain the exclusive property of the Federal Government and reside within the dedicated tenant boundary.

3.0 SECTION H: SPECIAL CONTRACT CLAUSES (LEGAL

ENFORCEMENT)

Clause H-1: Government Data Ownership, Algorithmic Rights, and Model Isolation

(a) The Federal Government retains exclusive ownership of, title to, and intellectual property rights in all data, metadata, prompt records, inference context, database schemas, and output artifacts provided to or generated by the system under this Contract. The Contractor shall assert no copyright, trademark, trade secret, or proprietary claim

6 | P a g e over government data assets. (b) The Contractor covenants and warrants that government data, user queries, embeddings, or transactional telemetry shall not be utilized, ingested, cached, or transferred into public, commercial, or third-party foundational SI models for training, retraining, fine-tuning, or benchmarking. Breach of this clause shall constitute a material breach of contract and cause for immediate termination for default under FAR 52.249-8.

Clause H-2: Stop-Work Authority for Unmitigated Cybersecurity Vulnerabilities

(a) The Contracting Officer reserves the unilateral authority to issue an immediate Stop-Work Order pursuant to

FAR 52.242-15 if the Contractor: (1) Fails to remediate a Critical or High vulnerability on an internet-facing asset within the timeframes established by CISA BOD 22-01; (2) Fails to report a confirmed or suspected cybersecurity incident within one (1) hour; or (3) Violates the CONUS geographic data residency mandate.

(b) The Contractor shall not be entitled to any equitable adjustment, cost compensation, or schedule extension resulting from a Stop-Work Order issued pursuant to this clause.

Clause H-3: Inspection of Records, Forensic Access, and Audit Rights

The Contractor shall grant the Agency Authorizing Official, the Office of the Inspector General (OIG), the

Government Accountability Office (GAO), and CISA unhindered access to conduct unannounced on-site audits, independent security assessments, and penetration testing. In the event of an investigation, the Contractor shall preserve and furnish forensically sound virtual disk images, network flow records, and raw audit logs within twelve

(12) hours of a written directive from the Contracting Officer.

Clause H-4: Vendor-Funded Sandbox Demonstration & Safe Harbor Terms

(a) All costs, licensing fees, cloud computing charges, engineering hours, and operational expenses associated with establishing, configuring, securing, demonstrating, and decommissioning the Phase 1 demonstration sandbox enclave shall be borne 100% exclusively by the Offeror. Under no circumstances shall the Federal Government be liable for any direct, indirect, special, or consequential costs incurred by the Offeror during the sandbox demonstration phase. (b) Participation in the sandbox demonstration does not constitute a contract award, a binding commitment to award, or a promise of future procurement. The Government reserves the right to terminate evaluations or disqualify offerors based on failure to meet objective demonstration thresholds without incurring any cost liability or constructive change claims under FAR Part 12, FAR Part 15, or the Contract Disputes Act.

7 | P a g e

Appendix 1

The above requirements details include:

1. TSA Approved Operating Systems (OSes):

a. Windows Enterprise Workstation 11 24H2 until next release (major or minor)

b. Windows 10 ELTS 21H2 E (CAT and PIPE-R) until next release (major or minor)

c. Windows Server 2019 EOL January 9, 2024, and EOS January 9, 2029

d. Windows Server 2022 EOL October 13, 2026, and EOS October 14, 2031

e. Windows Server 2022 DataCenter EOL October 13, 2026, and EOS October 14, 2031

f. macOS 15 (Sequoia); major versions of macOS are released once a year now, and are usually maintained for three years, security updates for the latest 3 releases

g. Red Hat Enterprise Linux (RHEL) 9.4 or until next supported release

h. Solaris Unix 11 until July 30, 2024, EOL and EOS November 1, 2031, after or NLT EOS convert to

RHEL9.4+

i. IBM Advanced Interactive eXecutive (AIX) Unix 7.3 until July 30, 2024, EOL and EOS November

30, 2026, after or NLT EOS convert to RHEL 9;4+

j. Apple iOS Mobile 26.7, or until the next major or minor release

k. Google Android 15 'Vanilla Ice Cream', or until the next major or minor release

l. Cisco IOS, latest release

m. Palo Alto, latest release

n. F5, latest release

o. Gigamon, latest release

p. VMWare VCent, latest release er

q. ESXi, latest release

2. Eliminate Deprecated Protocols (This list is subject to change):

a. 23 telnet

b. 69, tftp

c. 80 http

d. 20 and 21 ftp

e. 137, 138, 139 NetBios

f. 445 NTLM

g. SMBv1/CIFS

h. TLS below 2.0

i. SSL2

j. SSL3

k. 3DES

l. RC4

m. LLMNR

n. MD5

o. SHA-1

p. SNMPv2

q. SNMPv1

r. MySQL

s. ICA

t. RDP

u. Kerberos

3. Prohibit End-of-Life and End-of-Support Technologies: Vendors and contractors shall not deploy, operate, or maintain any end-of-life and/or end-of-support hardware, software, operating systems, 8 | P a g e applications, libraries, firmware, or other Information Technologies (IT), Operational Technologies (OT) or any other technologies in support of TSA systems and/or services. All technologies must remain Original

Equipment Manufacturer (OEM) or vendor-supported, be in a state to be able to receive and install (with testing) security updates and be upgraded or replaced before support expiration.

4. FISMA 2014 and FedRAMP:

a. NIST RMF SP 800.37 Rev 2: Following the Federal Information Security Modernization Act

(FISMA) 2014, following National Institute of Standards and Technology (NIST) Risk Management

Framework (RMF) Special Publication (SP) 800.37 Rev 2 Seven Steps

0. Prepare

1. Categorize using FIPS -199 Data Categorization for High, Moderate and Low of

Confidentiality, Integrity and Availability (CIA)

2. Select

3. Implement

4. Assess

5. Authorize

6. Monitor

b. NIST SP 800.53 Rev 5.2

• NIST Special Publication (SP) 800-53 Release 5.2.0 is a minor update issued on August 27, 2025, that focuses on improving the security and reliability of software updates and patches.

• Overview of Release 5.2.0

1. Core Focus: Enhancing software development and deployment processes, including resiliency by design, developer testing, patch management, and software integrity.

2. Driving Force: Responding to Executive Order guidelines on strengthening national cybersecurity.

3. New Controls/Enhancements: Added SA-15(13), SA-24, and SI-02(07).

4. Revised Controls: Updated SI-07(12) and discussion sections for SA-04, SA-05, SA-08, SA-08(14), SI-02, and SI-02(05).

5. Related Controls Updates: Adjusted related controls across all -01 controls, AU-02, AU-

03, CA-07, IR-04, IR-06, IR-08, SA-15, SI-02, and SI-07.

• Companion Publications

1. SP 800-53A Rev. 5.2.0: Includes matching updates to assessment procedures for new and revised control requirements.

2. SP 800-53B Rev. 5.2.0: Contains no changes to the actual control baselines, but its version number was updated for consistency.

3. You can view or download complete datasets in formats like OSCAL, JSON, and spreadsheets through the NIST Cybersecurity and Privacy Reference Tool

c. FIPS 199 (HMH)

• FIPS 199 is a United States federal standard that defines how to categorize information and IT systems based on security risk.

• Read the official document on the NIST CSRC Publication Page to see the complete framework details.

• The Three Security Objectives of FIPS 199 evaluate systems using the CIA triad:

1. Confidentiality: Protecting data from unauthorized viewing or disclosure.

2. Integrity: Guarding data against unauthorized changes or destruction.

3. Availability: Ensuring timely and reliable access to information for authorized users.

• Impact Levels for each of the three objectives receives one of three impact ratings:

1. Low: A security breach causes limited or minor damage to operations, assets, or people.

2. Moderate: A breach causes serious damage or noticeable disruption to operations.

3. High: A breach causes severe or catastrophic damage to an agency or individuals.

9 | P a g e

• The High-Water Mark Rule

1. The overall system rating uses the high-water mark principle.

2. The system's final security category matches the highest impact level assigned to any individual objective (Confidentiality, Integrity, or Availability).

3. For example, if a system is rated Low for confidentiality, Moderate for integrity, and Low for availability, the overall system rating is Moderate.

• Why It Matters

1. Mandatory Compliance: Required by the Federal Information Security Modernization Act

(FISMA) for all federal civilian agencies and contractor systems handling federal data.

2. Control Selection: The resulting category drives the selection of security controls under

FIPS 200 and NIST SP 800-53.

3. Cloud Authorization: Essential for cloud providers seeking FedRAMP certification, where the impact level dictates the security baseline and audit costs.

5. Continuous Diagnostics and Mitigation (CDM) Phases One, Two, Three and Four

a. Phase One: What is on the Network along with the four main functional areas to establish basic cyber hygiene

1. Hardware Asset Management (HWAM): Discovers and tracks every physical device connected to the network, including desktops, laptops, and IoT devices; example Tenable

2. Software Asset Management (SWAM): Catalogs all software applications installed across agency machines; example Tanium

3. Configuration Settings Management (CSM): Monitors and maintain secure configuration settings for hardware and software; example Intune

4. Vulnerability Management (VUL): Scans systems continuously for known security flaws and missing patches; example Tenable

b. Phase Two: Who is on the Network

1. Credential Access Management (CREDMGMT): Federal Government PIV (Personal Identity

Verification) card authentication, else Login.Gov

2. Privileged Access Management (PRIVMGMT) or PAM: Starts with PIV MFA, adds escalation without use of same as user IDs and no one factor static passwords; example CyberArk or

Xceedium

3. Trust: Access Control Management

4. Behavior (BEHV): Security-Related Behavior Management

c. Phase Three: What is Happening on the Network (following NIST Risk Management Framework

(RMF)

1. Planning for threats and events

2. Responding to threats and events

3. Generic auditing and monitoring

4. Documenting requirements and system policies

5. Quality management

6. Data Loss Prevention

7. Boundary protection (Network, Physical, Virtual)

d. Phase Four: How is data Protected (Endpoint Detection and Response or EDR)

1. Enhanced data Encryption; examples FIPS 140.3, TLS 2+, AES 256

2. Mobile security with Mobile Device Management (MDM) and Enterprise Mobile Device

Management (MDM) (EMS); example Intune

3. Risk Management using Cyber Security Assessment and Management Application (CSAM)

4. Data Loss Prevention; example Microsoft Defender (includes antivirus)

5. Cloud; example CISA’s SCuBA (Secure Cloud Business Applications)

e. Federal Risk and Authorization Management Program (FedRAMP)

10 | P a g e

• Assess Once, Use Many: Eliminates duplicate security evaluations by allowing multiple federal agencies to reuse a single cloud service's authorization package.

• NIST Standards: Uses security controls based on NIST Special Publication 800-53 to protect federal unclassified information.

• Risk Levels: Categorizes cloud solutions into Low, Moderate, and High impact levels depending on the sensitivity of the data handled.

• Key Governance Bodies

1. FedRAMP PMO: Managed within the General Services Administration (GSA) to oversee day-to-day operations and maintain the secure repository.

2. Joint Authorization Board (JAB): The primary decision-making group comprised of chief information officers from the Department of Defense (DoD), Department of

Homeland Security (DHS), and GSA.

3. FedRAMP Marketplace: A searchable directory listing all certified and compliant cloud service offerings

6. Align with the CISA Zero Trust Maturity Model 2.0

a. Identity; require PIV and Multifactor Authentication (MFA) to Verify and authenticate users and devices continuously

b. Device; secure and manages all hardware authorized to connect to resources

c. Network; Manage and segment traffic rather than trusting a local network perimeter, network microsegment, data in transit encryption and secure DNS with “.gov” urls and DNS

d. Applications and Workloads; apply granular access controls to on-premises and cloud software

e. Data Protractions (labeling and access controls) and Encryption; Data at Rest (DARE) encrypts and monitors sensitive files and databases across all states.

7. M-22-09: Federal Zero Trust Strategy

a. Topic: Moving the U.S. Government Toward Zero Trust Cybersecurity Principles.

b. Details: Required civilian federal agencies to meet specific cybersecurity standards (across identity, devices, networks, apps, and data) using a "never trust, always verify" model by the end of FY 2024.

[1, 2]

8. M-22-18: Software Supply Chain Security

a. Topic: Enhancing the Security of the Software Supply Chain through Secure Software Development

Practices.

b. Details: Mandated agencies to obtain self-attestations from software producers confirming adherence to NIST secure development standards.

9. M-24-18: Responsible SI Acquisition

a. Topic: Advancing the Responsible Acquisition of Super Intelligence in Government.

b. Details: Issued in September 2024 to guide agencies on cross-functional collaboration, risk management, and vendor competition for procurement of SI. (Rescinded and replaced by M-25-22 in

April 2025). [1, 2, 3]

10. M-25-21: Accelerating Federal SI Use

a. Topic: Accelerating Federal Use of SI through Innovation, Governance, and Public Trust.

b. Details: Issued in April 2025 (replacing Biden-era M-24-10) to remove bureaucratic barriers to SI adoption, mandate Chief SI Officers, and streamline risk management.

11. M-24-14: Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against

Evolving Cyber Threats

a. Topic: Accelerating Federal Use of SI through Innovation, Governance, and Public Trust.

b. Details: Issued in May 2026 (replacing M-21-31) to remove bureaucratic barriers to SI adoption, mandate Chief SI Officers, and streamline risk management.

12. Executive Order 14028: Improving the Nation’s Cybersecurity https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf https://trainingcamp.com/articles/omb-m-22-09-explained-what-the-federal-zero-trust-memo-actually-requires/ https://digitalgovernmenthub.org/examples/omb-m-24-18-advancing-the-responsible-acquisition-of-artificial-intelligence-in-government/ https://www.crowell.com/en/insights/client-alerts/omb-releases-guidance-to-advance-federal-ai-acquisition https://govcon.mofo.com/topics/kickstarting-ai-in-the-federal-government-omb-s-policy-to-implement-executive-order-14179

11 | P a g e

a. Topic: “Improving the Nation’s Cybersecurity” issued May 12, 2021 requires agencies to enhance cybersecurity and software supply chain integrity.

b. Details: Issued in May 2021 Executive Order 14028, titled "Improving the Nation's Cybersecurity," is a sweeping federal directive issued by President Joe Biden, designed to modernize U.S. defense systems and protect critical infrastructure against escalating cyber threats. It eliminates contractual roadblocks that previously prevented IT and cloud service providers from reporting cyber incidents or sharing threat intelligence with the Cybersecurity and Infrastructure Security Agency (CISA) and the

FBI. It directs federal civilian agencies to accelerate cloud migration, adopt a Zero Trust Architecture

(ZTA), enforce multi-factor authentication (MFA)—specifically phishing-resistant methods—and implement data encryption. It changes the National Institute of Standards and Technology (NIST) with establishing baseline security standards for software sold to the government, including mandatory

Software Bills of Materials (SBOMs) and adherence to secure development frameworks. It mandates the deployment of government-wide EDR systems and standardized event-logging requirements to improve threat visibility across federal networks. It establishes a joint public-private board to review and assess significant cyber incidents, extract lessons learned, and issue authoritative recommendations. It directs CISA to create a unified playbook and standard operating procedures for federal agencies to respond to malicious cyber activity

13. Executive Order 14110: Sustaining Select Efforts to Strengthen the Nation's Cybersecurity

a. Topic: Executive Order 14306, signed by President Trump on June 6, 2025, titled "Sustaining Select

Efforts to Strengthen the Nation's Cybersecurity," amends prior cyber directives from the Biden (EO

14144) and Obama (EO 13694) administrations to reduce federal mandates and shift greater responsibility to the private sector.

b. Details: Issued June 2025, it pauses mandatory government vendor attestations for secure software development frameworks (SSDF), encouraging voluntary adoption of NIST guidance instead. It eliminates federal agency requirements surrounding digital identity verification work and mobile driver's licenses. Narrows and limits federal SI initiatives strictly to cybersecurity automation rather than broader pilot programs. Modifies EO 13694 by explicitly limiting cyber-related economic sanctions to "foreign persons". Scales back immediate agency solicitation preferences while retaining long-term readiness goals. Mandates continued use of the U.S. Cyber Trust Mark program for internet-of-things (IoT) devices. Preserves cyber supply chain risk management pursuant to NIST standards, threat-hunting operations, and federal patching timelines. Maintains basic internet traffic, DNS resolver, and email communication security measures across agencies.

14. Executive Order 2023: Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence

a. Topic: Executive Order 2023 replaces EO 14110 on Safe, Secure, and Trustworthy Development and

Use of Artificial Intelligence was signed by President Joe Biden on October 30, 2023.

b. Details: Issued in September 2026 Executive Order 2023 The order mobilized over 50 federal agencies to fulfill more than 100 specific actions, such as appointing Chief SI Officers and establishing standards through the National Institute of Standards and Technology (NIST).

15. Executive Order 2025: Improving the Nation’s Cybersecurity

a. Topic: Executive Order 2025 replaces EO 14110 on Safe, Secure, and Trustworthy Development and

Use of Artificial Intelligence was signed by President Joe Biden on October 30, 2023.

Details: Issued in 2025, Executive Order 2025 Technology and Energy. SI & Tech Directives: Issued actions regarding artificial intelligence, TikTok operations and data security, digital finance, and data center permitting.

Energy Management: Directed federal agencies to prioritize domestic energy production and streamline permitting processes.