Enabling Zero Trust Security in the Public Sector

Issued on May 12, 2021, the Executive Order on Improving the Nation’s Cybersecurity states that “The Federal Government must adopt security best practices; advance toward Zero Trust Architecture; accelerate movement to secure cloud services, including Software as a Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS); centralize and streamline access to cybersecurity data to drive analytics for identifying and managing cybersecurity risks; and invest in both technology and personnel to match these modernization goals.” 

In accordance with this executive order, the Cybersecurity & Infrastructure Security Agency (CISA) has published the following definition of critical software that it deems as needing to conform to these larger zero trust security considerations and is thus subject to the further requirements of the executive order (EO). 

EO-critical software is defined as any software that has, or has direct software dependencies upon, one or more components with at least one of these attributes: 

• Is designed to run with elevated privilege or manage privileges; 
• Has direct or privileged access to networking or computing resources; 
• Is designed to control access to data or operational technology; 
• Performs a function critical to trust; or, 
• Operates outside of normal trust boundaries with privileged access.