"US Federal Agencies Miss Deadline for Incident Response Requirements"

According to the US Goverment Acountability Office (GAO), although US federal agencies have made progress in preparing for and responding to cyber threats, too many have failed to meet the deadline to implement incident response capabilities required by law.  The GAO found that 20 US federal agencies have not yet reached the advanced level, tier three, for cyber event logging.  According to 2021 Executive Order 14028, Cybersecurity Incident Response Requirements and Status of Completion, the US Office of Management and Budget (OMB) required all US federal agencies to work toward reaching event logging tier three by August 2023.  This tier three level means that logging requirements at all criticality levels are met.  However, the GAO noted that as of August 2023, only three of the 23 agencies were at tier three, three other agencies had reached the tier one level, and 17 had not gone past the tier zero level.  The GAO noted that until the agencies implement all event logging requirements, the federal government's ability to fully detect, investigate, and remediate cyber threats will be constrained. 

Infosecurity reports: "US Federal Agencies Miss Deadline for Incident Response Requirements"