Hatch, Stakeholders Diverge in Trump Cybersecurity EO Reactions

Sen. Orrin Hatch, R-Utah, and industry stakeholders diverged Thursday and Friday in statements on President Donald Trump’s cybersecurity executive order. The order, released Thursday after months of delays and drafts (see 1701310066 and 1702280065), directs the Office of Management and Budget and the Department of Homeland Security to assess all federal agencies' cybersecurity risks. It directs DHS and the Department of Commerce to explore ways to “promote action by appropriate stakeholders to improve the resilience of the internet and communications ecosystem and to encourage collaboration with the goal of dramatically reducing threats perpetrated by” botnets (see 1705110058). The EO “is an important step in modernizing and improving federal cybersecurity policies and protocols,” Hatch said. “For several years, I have been very concerned about the state of our federal government’s cybersecurity and computer systems.” Hatch said the order “mirrors the intent” of his enacted 2015 Federal Computer Security Act, which “was to require federal agencies to be accountable and proactive about securing critical infrastructure and computer systems from cyberattacks.” The Information Technology Industry Council believes the order “is a promising start for the administration’s cyber efforts,” said President Dean Garfield. “We are pleased to see the Trump Administration embrace actions we have consistently advocated for, including orienting federal government cybersecurity risk management around the [National Institute of Standards and Technology] Cybersecurity Framework and utilizing public-private partnerships to advance cybersecurity.” Cybersecurity IT company CSRA sees the EO as providing “a monumental boost to the effort to update and secure the government’s IT infrastructure,” said CEO Larry Prior. “Aging systems and outdated requirements are costing our government time and money, and jeopardizing our security.” The Information Technology and Innovation Foundation is “disappointed to see that this executive order is mostly a plan for the government to make a plan, not the private sector-led, actionable agenda that the country actually needs to address its most pressing cyber threats," said Vice President Daniel Castro. “This order leans heavily on the government for ideas and implementation rather than a public-private partnership approach.”