Sen. Mark Warner, D-VA, on Sept. 26 sent Shalanda Young, director of the Office of Management and Budget, a letter reminding her of the need to complete a review of her agency’s policies regarding the security of internet of things devices as required by law.
The review aims to ensure that OMB’s IoT policies are aligned with the cybersecurity guidelines endorsed by the National Institute of Standards and Technology, the office of Sen. Warner said Tuesday.
The OMB review and the issuance of NIST guidelines are mandated by the Internet of Things Cybersecurity Improvement Act of 2020, which Warner sponsored.
NIST complied with the legal requirement in 2021, when it published Special Publication 800-213A, titled, “IoT Device Cybersecurity Guidance for the Federal Government: IoT Device Cybersecurity Requirement Catalog.” OMB was supposed to complete its review within 180 days afterward.
In his letter to Young, Warner expressed concern and disappointment over OMB’s lack of “significant progress” in the conduct of its review. The lawmaker also asked Young to answer within 60 days several questions to determine whether the office is taking the appropriate steps to fulfill its obligation.
These inquiries include how far along OMB is in its IoT policy review, what policies the office has issued to ensure compliance with NIST guidance and which agencies have yet to align their policies with the NIST guidelines.
Warner concluded his letter by applauding OMB for its work in strengthening the cybersecurity of the federal government.