Original Coverage & Source Attribution: www.executivegov.com
- A federal sprint will assess how quickly agencies can remediate unsupported edge devices
- A second governmentwide CISO tabletop exercise will test incident response
- The 2026 FedCiv Summit will explore the proposed $76 billion FY2027 civilian IT budget
The Federal Chief Information Security Officer Council is pursuing four priorities aimed at shifting agencies from reacting to cyber incidents toward anticipating threats before they disrupt government services, GovCIO reported Friday.
Michael Duffy, acting federal CISO of the Office of Management and Budget, discussed the effort Wednesday at the American Council for Technology-Industry Advisory Council Cybersecurity Summit.
Duffy was a keynote speaker at Potomac Officers Club’s 2026 Cyber Summit held in May.
With the Potomac Officers Club’s 2026 FedCiv Summit just days away on Oct. 29, now is the time to register for discussions on federal cybersecurity, AI adoption, zero trust and other technologies shaping civilian IT. Save your seat today to hear government and industry leaders discuss these priorities in the context of the White House’s proposed $76 billion fiscal 2027 civilian IT budget.
What Steps Is the Council Taking?
The council is pursuing its first priority of reducing cyber exposure by running a sprint to assess how quickly agencies can remediate end-of-support edge devices with existing resources before the fiscal year closes. The effort stems from a directive covering those devices.
For operational resilience, preparations are underway for the second governmentwide CISO tabletop exercise. Scheduled for early November, the exercise will focus on AI-enabled cyberattacks and bring agency CISOs and security operations center directors together to assess governmentwide incident response, Federal News Network reported.
The council aims to test incident-response capabilities and coordination among agency CISOs and security operations center directors.
With AI integration into cybersecurity tools and operations a top priority, the council formed an AI security governance working group to develop repeatable approaches to system management, human oversight and risk-based decision-making. Agency and industry officials also gathered at the White House to pinpoint technologies agencies can use now rather than years from now.
What Is Duffy Asking of Agencies & Industry?
Duffy urged agencies to prioritize vulnerabilities according to their potential operational impact, focusing on known exploited vulnerabilities and weaknesses that threaten essential operations. Instead of giving every flaw equal weight, he said resources should be directed toward threats that could disrupt critical services.
As federal agencies adopt more integrated digital services, Duffy emphasized the need to protect sensitive data, application programming interfaces and connections between agencies. He added that modernization and cybersecurity should not be handled as separate functions.
Duffy called on vendors to keep building secure software and to be upfront about which of their offerings are deployable now and which remain aspirational.
The official also highlighted the need for standardized guidance, training and coordination among agencies to address post-quantum cryptography migration. The council recently launched a working group to coordinate preparations for the multiyear transition.
