FISMA coordination with CIRCIA + Zero Trust + Executive Orders + OMB Memoranda. CIRCIA (Cyber Incident Reporting for Critical Infrastructure Act of 2022): Final Rule effective 2026; expands incident reporting beyond FISMA-covered agencies to CRITICAL INFRASTRUCTURE entities; covered entities must report cyber incidents within 60 HOURS + ransom payments within 24 HOURS; supervised by CISA. ZERO TRUST ARCHITECTURE (ZTA): OMB MEMORANDUM M-22-09 (January 2022) - Moving the US Government Toward Zero Trust Cybersecurity Principles - sets federal Zero Trust strategy + 5 pillars (Identity + Devices + Network + Applications + Data) + mandates FY24 ZTA targets + 2024 ZTA STRATEGY update; CISA ZERO TRUST MATURITY MODEL v2 (2023) + provides 5-pillar + 3-maturity-level framework; phishing-resistant authentication mandatory; least-privilege + micro-segmentation expected. EXECUTIVE ORDERS: EO 14028 (May 2021 Improving the Nation Cybersecurity) - federal SBOM + Zero Trust + EDR + cloud security baselines; EO 14110 (October 2023 AI Executive Order - revoked January 2025 + replaced by 2025 EO on AI in Government) - federal AI safety + bias testing + watermarking + critical-infrastructure-AI; EO 14117 (February 2024 Cross-Border Data Transfer) - restrictions on data flows to countries of concern. OMB MEMORANDA: M-22-09 ZTA; M-22-18 SBOM Producer Attestation; M-23-02 Cybersecurity Information Sharing; M-24-15 FedRAMP Modernization; M-24-04 Annual FISMA Reporting Guidance.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.