2024-31479NoticeWallet

Government Finally Notices Foreign Countries Want Our Data

Published Date: 1/8/2025

Notice

Summary

CISA just released the final security rules to protect Americans' sensitive data from risky foreign countries, following President Biden’s Executive Order 14117. These rules affect businesses handling certain restricted transactions and kick in starting January 8, 2025. If you’re involved, get ready to follow new security steps to keep data safe—no extra costs were mentioned, but staying compliant is a must!

Analyzed Economic Effects

11 provisions identified: 5 benefits, 4 costs, 2 mixed.

Must follow CISA security requirements

If you are a U.S. person engaging in a DOJ-identified restricted transaction, you must implement the CISA organizational-, system-, and data-level security requirements to mitigate access by covered persons or countries of concern. The requirements are intended to allow restricted transactions to proceed only if those security measures are implemented.

Data must be denied or strongly mitigated before sharing

When covered data could be accessed by covered persons or countries of concern, you must either deny access to linkable, identifiable, unencrypted, or decryptable covered data or apply mitigations (for example, pseudonymization, de-identification, aggregation, or encryption) sufficient to prevent such access. Implementing these data-level techniques is required for restricted transactions to proceed.

Final rules take effect January 8, 2025

If your organization engages in restricted transactions, CISA's finalized security requirements take effect on January 8, 2025. That means the rules described in this notice apply starting on that date.

Patch known exploited vulnerabilities within 45 days

If you operate internet-facing covered systems, you must remediate known exploited vulnerabilities (KEVs) in a risk-informed order with all such KEVs remediated within 45 calendar days. You must also establish a process to evaluate whether internet-facing covered systems with KEVs were compromised prior to the patch being applied.

Require multi-factor authentication or 15‑char passwords

For covered systems, you must implement multi-factor authentication (MFA) that meets NIST AAL2/AAL3 (including passkeys) where technically feasible; if MFA is not technically feasible or enforced, passwords must be at least 15 characters. This requirement applies to systems that host covered data.

Covered system definition narrowed to bulk-interacting systems

CISA revised the definition of 'covered system' so it applies to systems that interact with covered data in bulk form, not ordinary user endpoints that only read or view data, except that any system interacting with government-related data remains a covered system. This changes which systems must meet the requirements.

Data risk assessment is for internal use only

You must perform a data risk assessment to inform protections, but CISA clarified the assessment is intended for internal use only and that documenting the assessment is not required. The plan should be reviewed internally by the organization.

Asset inventory requirement relaxed

CISA revised asset inventory rules to require documented inventories only 'to the maximum extent practicable,' removed the requirement to inventory MAC addresses, and allowed inventories to be dynamically curated. This relaxes some earlier inventory demands.

Access revocation timing changed to 'promptly'

CISA changed the requirement to revoke access for terminated or role-changed employees from 'immediately' to 'promptly' and provided clarifying examples of what 'promptly' means. This clarifies expected timing for access removal.

Change-management burden reduced

CISA reduced burden around change management by removing the reference to 'firmware' from certain installation rules and removing requirements for allowlists or approvals for specific software versions. This gives organizations more flexibility when installing new hardware or software.

Removed requirement on unauthorized media/hardware

CISA removed the earlier requirement that organizations maintain policies and processes to ensure unauthorized media and hardware are not connected to covered assets. CISA concluded other requirements coupled with the revised 'covered system' definition are sufficient.

Your PRIA Score

Score Hidden

Personalized for You

How does this regulation affect your finances?

Sign up for a PRIA Policy Scan to see your personalized alignment score for this federal register document and every other regulation we track. We analyze your financial profile against policy provisions to show you exactly what matters to your wallet.

Free to start

Key Dates

Published Date
1/8/2025

Department and Agencies

Department
Independent Agency
Source: View HTML

Related Federal Register Documents

Previous / Next Documents

Back to Federal Register