Cybersecurity Guide

Cybersecurity in the Federal Government

Last updated:

Written by Hugh Taylor

CISM-certified cybersecurity writer and editor with executive leadership experience at Microsoft and IBM.

In this guide

Federal government cybersecurity is the work of securing agency information systems, public services, sensitive records and national security operations against unauthorized access, theft, manipulation and disruption.

Individual agencies manage their own security, while specialized federal organizations provide coordination, intelligence, standards, investigations, military capabilities and oversight. There is no single organization responsible for every U.S. government network.

The stakes extend beyond a stolen file. An incident can interrupt federal services, expose personal or operational information, compromise trusted suppliers or affect defense and intelligence missions.

The Government Accountability Office (GAO) designated federal information security a high-risk issue and reported that more than 730 cybersecurity recommendations to agencies remained not fully implemented as of February 2026. Recommendations are not the same as confirmed breaches or job vacancies.

Who protects U.S. federal government systems?

CISA helps coordinate civilian federal cyber defense, but agencies remain responsible for their own networks. National security and military systems involve additional authorities, especially NSA and U.S. Cyber Command.

OrganizationWhat it doesNot its primary role
Federal agenciesOwn and implement security programs, authorize systems and respond to incidentsTransfer all accountability to a vendor
CISA, within DHSCoordinates federal civilian executive branch (FCEB) security operations and works with critical infrastructureRun every military and intelligence network
NSAProtects national security systems with cryptologic expertise and foreign-threat intelligenceServe as the general civilian cyber regulator
U.S. Cyber CommandLeads authorized military cyberspace planning and operations, including defense of military information networksReplace CISA’s civilian role
FBIInvestigates cyber intrusions and crimes, including cases involving private organizationsSet baseline technical controls for all agencies
NIST, OMB and ONCDRespectively develop technical guidance, establish executive-branch policy, and coordinate national cyber policyDirectly operate all agency security tools
GAO and inspectors generalEvaluate cybersecurity performance and accountabilityConduct agencies’ daily security operations

CISA’s September 2024 FOCAL Plan explains how it seeks to align operational defense across civilian agencies. The NSA focuses on national security systems. U.S. Cyber Command coordinates military operations and supports combatant commanders.

The FBI leads federal cyber investigations. Those functions can cooperate during an incident without becoming interchangeable.

Check out this episode of the Cybersecurity Podcast with Dr. Alex Bardas from the University of Kansas.

What are the main cybersecurity threats to federal agencies?

Espionage, compromised identities, exploited vulnerabilities, criminal intrusions and third-party dependencies are central federal cybersecurity risks. Their effects differ with the agency’s mission and the sensitivity of the affected system.

  • Nation-state intrusion: Foreign intelligence actors pursue sensitive data, credentials and persistent access. Their activity may target federal systems or privately operated infrastructure.
  • Stolen or abused accounts: Phishing, credential theft and privileged vendor access can bypass a network perimeter. Strong authentication and least-privilege access are core defenses.
  • Exploited vulnerabilities: Attackers use exposed or unpatched products. CISA’s Known Exploited Vulnerabilities (KEV) Catalog identifies flaws with evidence of active exploitation.
  • Ransomware and other cybercrime: Criminal actors can disrupt services or steal information. The FBI investigates relevant violations; an incident’s actual cause must be established rather than assumed.
  • Software, cloud and supplier compromise: Dependence on external products expands the attack surface and makes assurance and monitoring essential.
  • Insider and operational error: Poor access termination, incorrect configurations and negligent or malicious activity can create serious exposure.

The same security event has different consequences if it involves a civilian benefits system, defense communications, confidential law enforcement records, or privately owned infrastructure. Accurate reporting identifies the actual operator, affected data and response authority.

What laws and standards guide federal cybersecurity?

FISMA sets federal agency information security responsibilities; NIST supplies technical standards and guidance; OMB issues government-wide policy; CISA can direct certain civilian security actions. These are related but not legally interchangeable.

FISMA and federal information security

The Federal Information Security Modernization Act of 2014 modernized the original Federal Information Security Management Act of 2002. It establishes agency accountability for risk-based information security programs, including systems operated by contractors on behalf of agencies. It does not place every ordinary federal vendor under an identical agency-wide FISMA program. Contract language and system-specific rules still matter.

The NIST documents readers should recognize

  • FIPS 199/200: Security impact categorization and minimum federal security requirements, as applicable.
  • NIST SP 800-37, Revision 2: Risk Management Framework (RMF) steps for categorizing, controlling, assessing, authorizing and monitoring systems.
  • NIST SP 800-53, Revision 5: Security and privacy control catalog. Release 5.2.0, issued in August 2025, updated guidance on secure software patching and updates.
  • NIST Cybersecurity Framework 2.0: Flexible cybersecurity outcomes organized as Govern, Identify, Protect, Detect, Respond and Recover. It is not automatically a binding requirement for every system.

Which CISA directives apply?

Binding Operational Directive 23-01 addresses asset discovery and vulnerability detection. BOD 22-01 requires covered FCEB agencies to remediate KEV-listed vulnerabilities by set dates. Such directives have statutory scope limitations, including national security system exclusions; they are not blanket rules for all businesses or military systems.

A separate national-security framework also matters. National Security Presidential Memorandum 12, issued June 12, 2026, addresses national security systems, the Committee on National Security Systems and the NSA director’s National Manager role. Civilian network policy cannot simply be assumed to apply unchanged to those systems.

Related resources

How does the federal government defend against cyberattacks?

The practical defense cycle is to know what systems exist, reduce unnecessary access, fix exploitable weaknesses, monitor activity, respond quickly and restore services. Federal standards organize that work; agencies must make it operational.

  1. Inventory and assess. Agencies classify data and systems, map assets and dependencies, and understand exposure. The risk determines which controls apply.
  2. Prevent avoidable access. Multifactor authentication, least privilege, secure configuration, and Zero Trust practices reduce reliance on a trusted network perimeter.
  3. Find and remediate weaknesses. Asset discovery, security monitoring, and the KEV program help direct attention toward vulnerabilities being exploited. CISA’s CDM program supports participating agencies through monitoring and visibility capabilities.
  4. Prepare for incidents. Agency responders investigate and contain threats, coordinate reporting and appropriate CISA/FBI support, preserve evidence and plan service recovery. The exact process depends on the systems and incident.
  5. Verify third-party and cloud controls. Agencies assess supplier risk and define responsibilities with cloud providers instead of treating a provider certification as a complete agency authorization.

What changed in federal cloud security in 2026?

FedRAMP supplies reusable federal cloud-service security assessments and certifications. According to its October 8, 2026 update, FedRAMP 20x and its Consolidated Rules were operating alongside the legacy Rev. 5 approach.

Class A, B and C options had launched, while Class D and broader transition work remained future program goals. FedRAMP announced a June 11, 2027 endpoint for processing new legacy Rev. 5 applications.

These program changes do not eliminate an agency’s responsibility for authorizing and securely operating its own cloud deployment.

What has changed in federal cybersecurity policy?

Federal policy in 2025–2026 increased attention to secure software, cloud modernization, post-quantum cryptography, AI-related risk and national security system governance. Different documents carry different legal force.

The June 6, 2025 Executive Order 14306 amended previous cyber orders and established tasks related to secure software, reliable patching, encryption, AI and other federal policies.

The March 6, 2026 Cyber Strategy for America states current administration priorities, including federal network modernization. The June 2026 NSPM-12 provides national security systems governance. A strategy announces direction; it does not prove its targets have been achieved.

What do major federal cybersecurity incidents teach us?

The clearest recurring lessons are supplier-access control, software integrity, and coordinated detection and response. Two incidents illustrate different ways federal systems can be exposed.

Treasury’s December 2024 compromise

Treasury disclosed an intrusion involving a compromised BeyondTrust remote-support service and access to some unclassified systems. Contemporaneous Reuters reporting described a compromised service key. The incident illustrates why third-party administrative access requires monitoring and careful limits.

The actor labels require precision. In Treasury’s January 17, 2025 sanctions notice, Yin Kecheng was linked to the Treasury compromise, while an entirely separate entity was described as associated with the Salt Typhoon telecommunications campaign.

The two incidents should not be called one operation without further evidence. Specific claims about more than 3,000 files or confirmed exposure of Committee on Foreign Investment in the United States information are not established by the primary evidence cited here.

The SolarWinds compromise identified in 2020

A compromised SolarWinds software update created access to several federal agencies. GAO’s investigation reports that the U.S. government attributed the operation to Russia’s Foreign Intelligence Service and describes coordinated federal response. The lesson is that supply-chain oversight must be paired with internal detection and interagency coordination.

Historical Office of Personnel Management breaches also illustrate personnel-data risks. For a current measure of oversight, GAO identified 16 open OPM CIO-related cybersecurity and IT-management recommendations in January 2026. That figure is not a current count of breached records.

Further reading: Cybersecurity careers, getting a security clearance, and the government-focused industry collection.

What cybersecurity jobs are available in the federal government?

Federal cybersecurity careers include security analysis, incident response, digital forensics, vulnerability management, secure engineering, threat intelligence, risk management and cloud security.

Opportunities exist in civilian agencies, military services, intelligence organizations and companies performing federal contracts. Qualifications, hiring eligibility and salaries vary by vacancy and employment system.

A workable entry path is to develop skills through a related degree, technical experience, labs or internships; select a cyber work area; then use the OPM cyber careers portal and USAJOBS to read specific position requirements. The NICE Workforce Framework offers common work-role terminology; its components were updated in April 2026. Students can also examine OPM’s Pathways opportunities.

NSF renamed CyberCorps Scholarship for Service to CyberAICorps Scholarship for Service in its 2026 program solicitation. Scholarship recipients at participating institutions are subject to qualifying government service commitments; students should verify current school-level availability and terms.

Do government cybersecurity jobs require a security clearance?

No, not all of them. USAJOBS explains that all federal jobs require appropriate background screening, but a Public Trust investigation is not a national security clearance. Some cyber roles involve no classified access; others require a clearance. Check each job posting’s security-clearance, citizenship, qualification and hiring-path fields.

Is there an official count of federal cyber employees?

The OPM Cyber Workforce Dashboard provides cyber workforce information for covered federal employee reporting. It should not be represented as an all-inclusive total covering civilian employees, military members and contractors without examining reporting scope. General U.S. cybersecurity job openings are not federal-only employment figures.

Frequently asked questions

Is CISA the same as NSA?

No. CISA coordinates civilian federal security and works with critical infrastructure; NSA’s cybersecurity mission centers on national security systems and related intelligence and cryptologic capabilities.

Is FISMA a cybersecurity certification every contractor needs?

No. FISMA imposes federal agency security responsibilities that include certain systems operated on an agency’s behalf. Contractual cybersecurity requirements differ by procurement, information type and applicable policy.

Who investigates a federal cyberattack?

Agency security teams lead their own technical response and may coordinate with CISA. The FBI investigates possible federal cyber crimes. Intelligence and military organizations can have separate responsibilities when national security systems or missions are affected.

Does the government protect private companies from cyberattacks?

The government supplies threat guidance, coordination, investigations and support programs, particularly for critical infrastructure, but private operators generally remain responsible for protecting their own networks. Federal assistance is not the same as government operation of a company’s security.

References