Memorandum 22-09 (M-22-09) from the White House Office of Management and Budget (OMB), is titled “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles.”
M-22-09 sets forth a Federal zero trust architecture (ZTA) strategy and requires agencies to meet specific cybersecurity standards and objectives by the end of FY 2024. These requirements are intended to reinforce the Government’s defenses against increasingly sophisticated and persistent threat campaigns that target Federal technology infrastructure – threatening public safety and privacy, damaging the American economy, and weakening trust in government.
This strategy places significant emphasis on stronger enterprise identity and access controls, including multi-factor authentication (MFA). This strategy sets a new baseline for access controls across the Government that prioritizes defense against sophisticated phishing, and directs agencies to consolidate identity systems so that protections and monitoring can be consistently applied. Agencies are directed to encrypt and authenticate all data traffic, including internal traffic.