On March 6, 2026, the Administration released “President Trump’s Cyber Strategy for America” alongside an Executive Order (entitled “Combating Cybercrime, Fraud, and Predatory Schemes Against American Citizens”) and accompanying Fact Sheet. The framework set forth in the Strategy document is significantly shorter and higher-level than the prior
Continue Reading White House Releases New National Cyber Strategy and Executive Order
CISA Releases New Guidance on Assembling Multi-Disciplinary Insider Threat Management Teams
On January 28, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) published a new resource on Assembling a Multi-Disciplinary Insider Threat Management Team. The guidance is intended to assist critical infrastructure stakeholders, which includes private sector entities across various sectors, with implementing an insider threat mitigation program that combines physical security, cybersecurity, personnel awareness, and community partnerships. Although framed for critical infrastructure, CISA’s guidance is relevant to a broader range of organizations, including those outside of critical infrastructure sectors—a point echoed in Covington’s 2025 insider threat webinar series, discussed further below.
Continue Reading CISA Releases New Guidance on Assembling Multi-Disciplinary Insider Threat Management TeamsCISA Announces Town Halls to Gather Input on CIRCIA Proposed Rule
Earlier this month, the U.S. Cybersecurity and Infrastructure Security Agency (“CISA”) announced a series of public town hall meetings to solicit additional stakeholder input on the Notice of Proposed Rulemaking (“Proposed Rule”) implementing the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (“CIRCIA”), which CISA published in April 2024.
Continue Reading CISA Announces Town Halls to Gather Input on CIRCIA Proposed RuleCybersecurity Information Sharing Act of 2015 Reauthorized Through September 2026
The Cybersecurity Information Sharing Act of 2015 (“CISA 2015”), which provides liability protections and other safeguards for sharing certain cybersecurity information with the U.S. federal government and private entities, was reauthorized as part of the funding bill enacted on February 3, 2026. CISA 2015’s information‑sharing provisions, which had been scheduled to sunset on January 30, 2026, will now remain in effect through September 30, 2026.
Continue Reading Cybersecurity Information Sharing Act of 2015 Reauthorized Through September 2026FTC Announces 10-Year Information Security Consent Orders with Illuminate Education and Illusory Systems
The Federal Trade Commission (FTC) recently announced that it agreed to proposed consent orders with two companies that experienced recent cybersecurity incidents, Illuminate Education (“Illuminate”) and Illusory Systems, which does business as Nomad (“Illusory”), to resolve allegations that both companies’ information security practices had violated Section 5 of the FTC
Continue Reading FTC Announces 10-Year Information Security Consent Orders with Illuminate Education and Illusory SystemsCISA Releases Cybersecurity Performance Goals 2.0 for Critical Infrastructure
On December 11, 2025, the U.S. Cybersecurity and Infrastructure Security Agency (“CISA”) released its Cybersecurity Performance Goals 2.0 (“CPG 2.0”), an update to its core set of recommended cybersecurity practices for critical infrastructure owners and operators, which we previously wrote about here. Established by the 2021 National Security Memorandum
Continue Reading CISA Releases Cybersecurity Performance Goals 2.0 for Critical InfrastructureCybersecurity Information Sharing Act of 2015 Reauthorized Through January 2026
The Cybersecurity Information Sharing Act of 2015 (“CISA 2015”), which provides protections for sharing cybersecurity threat information with the federal government and others, was reauthorized under the funding bill to reopen the federal government, which was enacted on November 12, 2025. The information sharing mechanisms and protections under CISA 2015, which had previously sunset on September 30, 2025, will now extend through January 30, 2026.
Continue Reading Cybersecurity Information Sharing Act of 2015 Reauthorized Through January 2026Cybersecurity Information Sharing Act of 2015 Allowed to Sunset
The Cybersecurity Information Sharing Act of 2015 (“CISA 2015”), which provided protections for sharing cybersecurity threat information with the federal government and others, officially sunset on September 30, 2025 pursuant to the law’s original sunset date after efforts to re-authorize it did not succeed. The law created a cybersecurity information
Continue Reading Cybersecurity Information Sharing Act of 2015 Allowed to SunsetCISA Delays Cyber Incident Reporting Rule for Critical Infrastructure
The U.S. Cybersecurity and Infrastructure Security Agency (“CISA”) plans to delay the publication of its much-anticipated cybersecurity incident reporting rule implementing the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (“CIRCIA”). According to an entry on the Spring 2025 Unified Agenda of Regulatory and Deregulatory Actions, released on September
Continue Reading CISA Delays Cyber Incident Reporting Rule for Critical InfrastructureCISA Publishes OT Asset Inventory Guidance for Critical Infrastructure
Last month, the U.S. Cybersecurity and Infrastructure Security Agency (“CISA”), in partnership with the Federal Bureau of Investigation (“FBI”), National Security Agency, Environmental Protection Agency, and cybersecurity authorities in Australia, Canada, Germany, Netherlands, and New Zealand, published new cybersecurity guidance (the “Guidance”) related to operational technology (“OT”), i.e., systems and devices that interact with a physical environment that are commonly used in manufacturing, utilities, oil and gas production, transportation, and other industrial operations. The Guidance, which will be of interest to any organizations that have an OT environment, is intended to help critical infrastructure entities develop and implement an OT asset inventory and taxonomy to protect their critical assets and improve incident response preparedness. It comes in advance of upcoming cyber incident reporting requirements for critical infrastructure in the U.S. under the Cyber Incident Reporting for Critical Infrastructure Act (“CIRCIA”) and in the EU under the revised Network and Information Systems Directive (“NIS2 Directive”). The Guidance is the latest in a series of joint releases from CISA, FBI and other U.S. and international partners on various security-related topics largely intended for critical infrastructure, including AI data security, product security bad practices, quantum computing cyber threats, and secure software development.
Continue Reading CISA Publishes OT Asset Inventory Guidance for Critical Infrastructure