Acting Federal CISO Michael Duffy Outlines 4 Cybersecurity Priorities – ExecutiveGov
Photo: Michael Duffy/LinkedIn
The Federal Chief Information Security Officer Council is pursuing four priorities aimed at shifting agencies from reacting to cyber incidents toward anticipating threats before they disrupt government services, GovCIO reported Friday.
Table of Contents
Michael Duffy, acting federal CISO of the Office of Management and Budget, discussed the effort Wednesday at the American Council for Technology-Industry Advisory Council Cybersecurity Summit.
Duffy was a keynote speaker at Potomac Officers Club’s 2026 Cyber Summit held in May.
With the Potomac Officers Club’s 2026 FedCiv Summit just days away on Oct. 29, now is the time to register for discussions on federal cybersecurity, AI adoption, zero trust and other technologies shaping civilian IT. Save your seat today to hear government and industry leaders discuss these priorities in the context of the White House’s proposed $76 billion fiscal 2027 civilian IT budget.
The council is pursuing its first priority of reducing cyber exposure by running a sprint to assess how quickly agencies can remediate end-of-support edge devices with existing resources before the fiscal year closes. The effort stems from a directive covering those devices.
For operational resilience, preparations are underway for the second governmentwide CISO tabletop exercise. Scheduled for early November, the exercise will focus on AI-enabled cyberattacks and bring agency CISOs and security operations center directors together to assess governmentwide incident response, Federal News Network reported.
The council aims to test incident-response capabilities and coordination among agency CISOs and security operations center directors.
With AI integration into cybersecurity tools and operations a top priority, the council formed an AI security governance working group to develop repeatable approaches to system management, human oversight and risk-based decision-making. Agency and industry officials also gathered at the White House to pinpoint technologies agencies can use now rather than years from now.
Duffy urged agencies to prioritize vulnerabilities according to their potential operational impact, focusing on known exploited vulnerabilities and weaknesses that threaten essential operations. Instead of giving every flaw equal weight, he said resources should be directed toward threats that could disrupt critical services.
As federal agencies adopt more integrated digital services, Duffy emphasized the need to protect sensitive data, application programming interfaces and connections between agencies. He added that modernization and cybersecurity should not be handled as separate functions.
Duffy called on vendors to keep building secure software and to be upfront about which of their offerings are deployable now and which remain aspirational.
The official also highlighted the need for standardized guidance, training and coordination among agencies to address post-quantum cryptography migration. The council recently launched a working group to coordinate preparations for the multiyear transition.
The Department of Defense said the department hasn't assessed the proposed separation of the U.S. Cyber Command and the National Security Agency, which shares leadership, infrastructure and talent,…
Cybersecurity and Infrastructure Security Agency senior advisers Bob Lord and Lauren Zabierek announced that they are resigning from their roles at CISA, Nextgov/FCW reported Monday.“While CISA’s approaches to…
Will Roper, assistant secretary of the Air Force for acquisition, technology and logistics, said that the service has a four-step plan to streamline the acquisition process, USAF said…
Airmen from the U.S. Air Force’s active-duty 388th and reserve 419 Fighter Wings have performed joint training exercises on F-35A, F-15C and F-15E aircraft variants at a military air base near Lakenheath, England….
GovCon Index continued its upward trend last week with a 1.90% increase that lifted the average to $4,879.91. GovCon Index is an aggregate index that tracks and presents…
ExecutiveGov, published by Executive Mosaic, is a site dedicated to the news and headlines in the federal government. ExecutiveGov serves as a news source for the hot topics and issues facing federal government departments and agencies such as Gov 2.0, cybersecurity policy, health IT, green IT and national security. We also aim to spotlight various federal government employees and interview key government executives whose impact resonates beyond their agency.
Copyright 2026 Executive Mosaic. All Rights Reserved. Site Archive
Copyright 2026 Executive Mosaic. All Rights Reserved. Site Archive
Get your latest GovCon news and insights. Become a VIP and subscribe to the GovConWire Daily News.
source
This article was autogenerated from a news feed from CDO TIMES selected high quality news and research sources. There was no editorial review conducted beyond that by CDO TIMES staff. Need help with any of the topics in our articles? Schedule your free CDO TIMES Tech Navigator call today to stay ahead of the curve and gain insider advantages to propel your business!
The Federal Chief Information Security Officer Council is pursuing four priorities aimed at shifting agencies from reacting to cyber incidents toward anticipating threats before they disrupt government services, GovCIO reported Friday.
Table of Contents
Michael Duffy, acting federal CISO of the Office of Management and Budget, discussed the effort Wednesday at the American Council for Technology-Industry Advisory Council Cybersecurity Summit.
Duffy was a keynote speaker at Potomac Officers Club’s 2026 Cyber Summit held in May.
With the Potomac Officers Club’s 2026 FedCiv Summit just days away on Oct. 29, now is the time to register for discussions on federal cybersecurity, AI adoption, zero trust and other technologies shaping civilian IT. Save your seat today to hear government and industry leaders discuss these priorities in the context of the White House’s proposed $76 billion fiscal 2027 civilian IT budget.
The council is pursuing its first priority of reducing cyber exposure by running a sprint to assess how quickly agencies can remediate end-of-support edge devices with existing resources before the fiscal year closes. The effort stems from a directive covering those devices.
For operational resilience, preparations are underway for the second governmentwide CISO tabletop exercise. Scheduled for early November, the exercise will focus on AI-enabled cyberattacks and bring agency CISOs and security operations center directors together to assess governmentwide incident response, Federal News Network reported.
The council aims to test incident-response capabilities and coordination among agency CISOs and security operations center directors.
With AI integration into cybersecurity tools and operations a top priority, the council formed an AI security governance working group to develop repeatable approaches to system management, human oversight and risk-based decision-making. Agency and industry officials also gathered at the White House to pinpoint technologies agencies can use now rather than years from now.
Duffy urged agencies to prioritize vulnerabilities according to their potential operational impact, focusing on known exploited vulnerabilities and weaknesses that threaten essential operations. Instead of giving every flaw equal weight, he said resources should be directed toward threats that could disrupt critical services.
As federal agencies adopt more integrated digital services, Duffy emphasized the need to protect sensitive data, application programming interfaces and connections between agencies. He added that modernization and cybersecurity should not be handled as separate functions.
Duffy called on vendors to keep building secure software and to be upfront about which of their offerings are deployable now and which remain aspirational.
The official also highlighted the need for standardized guidance, training and coordination among agencies to address post-quantum cryptography migration. The council recently launched a working group to coordinate preparations for the multiyear transition.
The Department of Defense said the department hasn't assessed the proposed separation of the U.S. Cyber Command and the National Security Agency, which shares leadership, infrastructure and talent,…
Cybersecurity and Infrastructure Security Agency senior advisers Bob Lord and Lauren Zabierek announced that they are resigning from their roles at CISA, Nextgov/FCW reported Monday.“While CISA’s approaches to…
Will Roper, assistant secretary of the Air Force for acquisition, technology and logistics, said that the service has a four-step plan to streamline the acquisition process, USAF said…
Airmen from the U.S. Air Force’s active-duty 388th and reserve 419 Fighter Wings have performed joint training exercises on F-35A, F-15C and F-15E aircraft variants at a military air base near Lakenheath, England….
GovCon Index continued its upward trend last week with a 1.90% increase that lifted the average to $4,879.91. GovCon Index is an aggregate index that tracks and presents…
ExecutiveGov, published by Executive Mosaic, is a site dedicated to the news and headlines in the federal government. ExecutiveGov serves as a news source for the hot topics and issues facing federal government departments and agencies such as Gov 2.0, cybersecurity policy, health IT, green IT and national security. We also aim to spotlight various federal government employees and interview key government executives whose impact resonates beyond their agency.
Copyright 2026 Executive Mosaic. All Rights Reserved. Site Archive
Copyright 2026 Executive Mosaic. All Rights Reserved. Site Archive
Get your latest GovCon news and insights. Become a VIP and subscribe to the GovConWire Daily News.
source
This article was autogenerated from a news feed from CDO TIMES selected high quality news and research sources. There was no editorial review conducted beyond that by CDO TIMES staff. Need help with any of the topics in our articles? Schedule your free CDO TIMES Tech Navigator call today to stay ahead of the curve and gain insider advantages to propel your business!
