Cybersecurity Baselines Retrospective Briefing — December 10, 2021
Zero trust architectures, federal emergency directives, and collaborative defence bodies launched in 2020–2021 now anchor enterprise cybersecurity baselines, demanding sustained investment in identity, telemetry, and vulnerability governance.
Executive briefing: The 2020–2021 threat cycle reshaped baseline expectations for enterprise cybersecurity. NIST formalised zero trust architecture (ZTA) guidance, CISA issued emergency directives following the SolarWinds compromise, Executive Order 14028 mandated software assurance and logging requirements, DHS stood up the Cyber Safety Review Board (CSRB), and CISA created the Joint Cyber Defense Collaborative (JCDC) while issuing Binding Operational Directive 22-01 to enforce vulnerability remediation timelines.123456 These actions collectively define the control stack that boards, regulators, and customers expect heading into 2022.
Timeline of foundational actions
September 2020 — NIST SP 800-207 Zero Trust Architecture. NIST codified principles for identity-centric access, continuous verification, policy decision points, and microsegmentation, providing reference deployment models for agencies and critical infrastructure.1 The document emphasises strong identity governance, device health telemetry, and dynamic access policies.
December 2020 — CISA Emergency Directive 21-01. In response to the SolarWinds Orion supply-chain compromise, CISA ordered federal civilian agencies to disconnect affected systems, collect forensic images, and report indicators within days, signalling regulators’ expectations for rapid incident response.2
May 2021 — Executive Order 14028. The order requires federal agencies and suppliers to adopt zero trust strategies, deliver software bills of materials (SBOMs), enable logging and event retention, and improve incident reporting.3 It directed NIST and other agencies to publish ZTA reference architectures and secure software development criteria.
July 2021 — DHS establishes the CSRB. DHS operationalised EO 14028 Section 5 by chartering the CSRB to review significant cyber incidents, coordinate lessons learned, and recommend systemic improvements.4
August 2021 — CISA launches the JCDC. The collaborative unites federal agencies, cloud providers, and critical infrastructure operators to conduct joint cyber defence planning, share real-time telemetry, and release coordinated advisories.5
November 2021 — CISA Binding Operational Directive 22-01. BOD 22-01 created the Known Exploited Vulnerabilities (KEV) catalogue with enforceable remediation deadlines for federal agencies, raising the bar for vulnerability management across industries.6
Strategic implications for enterprises
These actions cemented identity-centric security, rapid incident response, and collaborative defence as baseline expectations. Boards should integrate zero trust roadmaps into strategic plans, allocate funding for identity and access management (IAM), endpoint detection and response (EDR), and logging infrastructure, and ensure supply chain risk management aligns with EO 14028 requirements.13
Public-private collaboration through the JCDC and CSRB indicates regulators expect transparent information sharing and continuous improvement after major incidents.45 Organisations that participate in such initiatives can influence guidance, access threat intelligence, and demonstrate maturity to regulators and customers.
Control priorities
- Zero trust adoption. Map current network and identity architectures to NIST SP 800-207 components: policy enforcement points, policy engines, continuous diagnostics, and session protection. Implement least-privilege access, multi-factor authentication, device posture checks, and microsegmentation.13
- Incident response readiness. Align response plans with CISA emergency directive expectations—capable of disconnecting systems, capturing forensic images, and providing rapid situational reports. Maintain pre-approved maintenance windows and executive communication protocols.2
- Software supply chain security. Build SBOM generation into development pipelines, adopt secure software development frameworks, and require vendors to attest to EO 14028-aligned practices, including vulnerability disclosure programs.3
- Collaborative defence. Establish points of contact for JCDC-style information sharing, subscribe to KEV catalogue updates, and participate in industry ISAC/ISAO activities to enhance situational awareness.56
- Vulnerability governance. Implement risk-based patch management aligned with KEV deadlines (e.g., 2-week remediation for critical federal vulnerabilities). Track exceptions, compensating controls, and executive sign-off.6
Implementation roadmap
- Assessment. Perform a maturity assessment against zero trust, incident response, and vulnerability management baselines. Use NIST’s ZTA maturity models and EO 14028 guidance to identify capability gaps.
- Strategic planning. Develop a multi-year zero trust roadmap covering identity, device, network, application, and data pillars. Align capital expenditure and operational budgets with planned capabilities.
- Process refinement. Update incident response playbooks, vulnerability triage workflows, and vendor risk assessments to reflect KEV timelines and emergency directive scenarios.
- Technology deployment. Implement identity federation, privileged access management, microsegmentation, and continuous monitoring tools. Integrate logging into centralised SIEM platforms with long-term retention.
- Training and exercises. Conduct tabletop exercises simulating SolarWinds-style supply-chain attacks, run zero trust pilot rollouts, and practice KEV-driven patch sprints with cross-functional teams.
- Metrics and reporting. Establish dashboards that track zero trust adoption milestones, incident response readiness scores, and KEV remediation progress for board oversight.
Metrics and assurance
- Key risk indicators. Monitor the percentage of high-value assets lacking multi-factor authentication, time to isolate compromised systems during exercises, and count of overdue KEV vulnerabilities.
- Key performance indicators. Track completion of zero trust capabilities (e.g., identity federation coverage, microsegmented workloads), mean time to patch critical vulnerabilities, and SBOM generation rates.
- Assurance activities. Align internal audit with EO 14028 requirements, test controls using red/blue team exercises, and document remediation of findings from CSRB reviews or JCDC advisories.
- Stakeholder reporting. Provide quarterly board updates summarising zero trust progress, incident simulations, and vulnerability metrics. Include lessons from JCDC intelligence or CSRB reports.
Sector-specific emphasis
- Financial services. Align zero trust and KEV remediation with FFIEC guidance, ensuring resilience for real-time payment and trading systems.
- Healthcare. Integrate zero trust controls into clinical networks without disrupting patient care; coordinate with HHS for incident reporting stemming from supply-chain attacks.
- Energy. Coordinate with DOE and sector coordinating councils on JCDC initiatives addressing pipeline and grid threats; implement segmentation between IT and OT environments.
- Technology vendors. Embed secure development practices mandated by EO 14028 and provide customer attestations covering SBOMs, logging, and incident notification commitments.
Programme risks and mitigations
- Legacy systems. Mitigation: implement segmentation, application gateways, and identity overlays to extend zero trust principles without disrupting legacy operations.
- Resource constraints. Mitigation: prioritise high-value assets, leverage managed services (MDR, MSSP) for monitoring, and seek cyber grants or shared services when available.
- Change fatigue. Mitigation: sequence initiatives, communicate business benefits, and align zero trust adoption with user experience improvements (single sign-on, adaptive access).
- Vendor dependencies. Mitigation: embed zero trust and KEV requirements into contracts, demand SBOMs, and maintain alternative suppliers where feasible.
Forward look
EO 14028 and BOD 22-01 have triggered cascading guidance: OMB issued memoranda requiring federal agencies to implement zero trust by FY 2024, while CISA continues to expand the KEV catalogue.36 Organisations should expect regulators and customers to demand evidence of zero trust progress, SBOM availability, and rapid vulnerability remediation. Participation in CSRB reviews and JCDC planning will shape future best practices, so investing in collaborative defence capabilities offers both compliance and resilience dividends.
Sources
- 1 NIST Special Publication 800-207: Zero Trust Architecture.
- 2 CISA Emergency Directive 21-01.
- 3 Executive Order 14028: Improving the Nation’s Cybersecurity.
- 4 DHS determination establishing the Cyber Safety Review Board.
- 5 CISA press release launching the Joint Cyber Defense Collaborative.
- 6 CISA Binding Operational Directive 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities.
Zeph Tech aligns cybersecurity programmes with zero trust, incident response, and vulnerability governance expectations emerging from 2020–2021 federal actions.
Continue in the Cybersecurity pillar
Return to the hub for curated research and deep-dive guides.
Latest guides
-
Cybersecurity Operations Playbook — Zeph Tech
Use Zeph Tech research to align NIST CSF 2.0, CISA KEV deadlines, and sector mandates across threat intelligence, exposure management, and incident response teams.