100 articles · Government · page 1 of 5
Articles
Week of 26 October 2026
OPM’s staffing-plan rule tucked a systems certification into a personnel regulation
OPM’s October 29 rule made workforce planning a quarterly data feed, moved the employee survey to agencies and had agency heads certify that their systems let HR leaders see the workforce. CIOs will carry much of it, on HR systems awaiting replacement.
Week of 12 October 2026
Ivanti’s October zero-day was a directory incident that came in through the VPN
CISA gave agencies three days to patch and triage Ivanti Connect Secure. The attacker left no implant on the gateway and used its directory account to hunt for administrator passwords and BitLocker keys. Permissions set long before decided how far that reached.
Week of 28 September 2026
Paused, not repealed: what CMMC’s suspension left defense contractors paying for
Six weeks before CMMC third-party certification was due to start, it sat suspended with no new date. Defense contractors setting budgets had to sort security spending into what was still owed, what could wait and what had changed price.
Week of 21 September 2026
Agency certificates now expire faster than agency budgets turn over
On October 1, 2026, the first day of the federal fiscal year, the first full-term 200-day website certificates ran out. Agencies built to buy, staff and schedule them once a year had to rethink all three.
Week of 17 August 2026
The dollar AI deals ended in a meter, and meters need ceilings
For a year, federal agencies got leading AI assistants for about a dollar. Six weeks before those deals expired, nobody knew what came next. Pay-as-you-go pricing was the likely answer, and it turns a procurement question into a budgeting one.
Week of 8 June 2026
Why World Cup cyber risk sat in the city services residents use every day
The stadiums had federal, state and venue security teams. The cyber risk host cities owned sat somewhere less obvious: in the everyday services around the matches, from parking sites and traffic signals to 911 dispatch and the vendors neighboring cities share.
Week of 27 April 2026
Lower quantum estimates moved signatures up the post-quantum queue
New research in spring 2026 lowered estimates of what a quantum computer would need to break today’s digital locks. For agencies, the urgent part was proof of identity rather than secrecy: certificates, smart cards and device keys take longest to replace.
Week of 20 April 2026
DOJ’s accessibility delay moved one date and put the budget at risk
The Justice Department pushed back its web accessibility deadline by a year, but the standard, the legal duty and residents’ experience stayed exactly where they were. The real risk was to budgets that had leaned on April 2026 to justify the work.
Week of 13 April 2026
Direct File’s quiet exit made retirement part of service design
The first tax deadline without IRS Direct File showed that switching off a public digital service is a piece of design work in its own right, with duties to returning users, to the states that connected to it, and to the public record.
Week of 16 March 2026
States could build Medicaid work requirements from the statute before the rule arrived
By spring 2026, states had nine months to put Medicaid work requirements into practice and no federal rule yet. The safe path: build what the law already fixed, make adjustable what the rule would decide, and lock in delivery capacity before it ran out.
Week of 23 February 2026
What a supply chain label on a U.S. AI vendor asked of agencies and contractors
As the administration moved to exclude Anthropic, agencies and contractors could not wait for the courts. The organizations that coped best asked three calm questions in order: which legal instrument applied, whom and which contracts it reached, and which uses it covered.
Week of 9 February 2026
What a second CISA lapse in five months asked state and local security teams to own
Homeland Security’s funding lapsed on February 14, and the nation’s cyber defense agency paused much of its help to states and localities for the second time in five months. Local leaders now had to decide which work to take on, buy or keep borrowing.
Week of 22 December 2025
Legal to fly, hard to replace: the FCC drone listing and public-safety fleets
The FCC’s December 22 action grounded no police or fire drone. It closed the door on new foreign-made models, turning every agency drone program into a question of spare parts, software support and who pays for the next fleet.
Week of 10 November 2025
CMMC’s first phase priced a signature, not a score
On November 10, 2025, Defense contracts began carrying CMMC cybersecurity requirements. Most eyes went to assessment levels, but the bigger change was a senior executive’s signature, which turned security claims into dated statements to the government with real legal weight.
Week of 3 November 2025
For SNAP systems, paying less was harder than paying nothing
During the 2025 shutdown, court orders pushed states toward partial and then full November SNAP food benefits within days. The systems that calculate, load and explain those benefits were built for paying in full or not at all, and paying less proved hardest.
Week of 22 September 2025
Persistence below the patch: what ED 25-03 asked agencies to prove about their firewalls
CISA’s Emergency Directive 25-03 described attackers who hid inside the startup code of Cisco firewalls, surviving restarts and upgrades. Applying a fix was no longer enough. Agencies had to prove each device could be trusted, and that the fix was the right one.
Week of 11 August 2025
Secrets in a public docket: the court filing breach and where the sensitive tier ends
The federal courts already had a separate path for their most sensitive documents when their filing system was breached in 2025. The trouble was where its boundary sat. Agencies holding dangerous records in general systems need a tier defined by consequence, not label.
Week of 4 August 2025
Cheap to license, slow to permit: federal AI’s bottleneck moved to the CISO’s desk
GSA’s August 2025 deals made leading AI tools nearly free for federal agencies. A $1 price grants none of the three permissions that decide real use: a security sign-off, a ruling on what data may go in, and an owner for records and oversight.
Week of 21 July 2025
ToolShell made patching the easy part of a SharePoint emergency
Attackers exploiting on-premises SharePoint in July 2025 stole the keys that let them come back after the patch. For agencies running collaboration servers in-house, the response became three jobs with different owners: patch, evict, and decide whether the server should exist at all.
Week of 14 July 2025
An escort who cannot read the command is not a security control
ProPublica’s report on Microsoft’s “digital escorts” showed that a cloud authorization says little about who actually runs a system. Agencies need personnel terms they can test: who can touch the system, how that work is checked, and what evidence reaches them.