<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.normaltextrun
{mso-style-name:normaltextrun;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D">FYI</span><o:p></o:p></p>
<p class="MsoNormal" style="line-height:105%"><a name="_Hlk84493246"><o:p> </o:p></a></p>
<span style="mso-bookmark:_Hlk84493246"></span>
<p class="MsoNormal"><span lang="EN">CISA is happy to </span><a href="https://cisa.gov/blog/2021/10/07/person-remote-and-hybrid-oh-my-securing-your-new-reality-tic-30"><span lang="EN">announce</span></a><span lang="EN"> the release of the finalized version
of the </span><a href="https://www.cisa.gov/publication/tic-30-core-guidance-documents"><span lang="EN">Remote User Use Case</span></a><span lang="EN">. The Remote User Use Case rescinds and replaces the
</span><a href="https://www.cisa.gov/publication/tic-30-interim-telework-guidance"><span lang="EN">TIC 3.0 Interim Telework Guidance</span></a><span lang="EN"> with guidance on applying network and multi-boundary security for agencies that permit remote users
on their networks. </span><span class="normaltextrun"><span style="color:black;background:white">CISA developed the Remote User Use Case in collaboration with the Office of Management and Budget (OMB), the General Services Administration (GSA), the
</span></span><span lang="EN">Federal Chief Information Security Officer (FCISO) Council</span><span class="normaltextrun"><span style="color:black;background:white">, and several agencies and industry experts that contributed their feedback during the public
comment period. </span></span><span lang="EN"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN">While developing the Remote User Use Case, CISA produced new TIC 3.0 security capabilities, which necessitated a refresh to the Security Capabilities Catalog.
</span><a href="https://www.cisa.gov/publication/tic-30-core-guidance-documents"><span lang="EN">Version 2.0 of the Security Capabilities Catalog</span></a><span lang="EN"> provides an updated list of deployable security controls, security capabilities, and
best practices, including capability identifiers and four new security capabilities: User Awareness and Training, Domain Name Monitoring, Application Container, and Remote Desktop Access.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN"><o:p> </o:p></span></p>
<p class="MsoNormal" style="line-height:105%">The release of these documents represents the conclusion of the adjudication period following the issuance of draft Remote User Use Case in December 2020. The feedback was adjudicated, and the draft use case was
modified to address the comments’ prevailing themes. A summary of the comments and CISA’s response is available in the
<a href="https://www.cisa.gov/publication/tic-30-core-guidance-documents">Response to Comments on TIC 3.0 Remote User Use Case</a>.<o:p></o:p></p>
<p class="MsoNormal" style="line-height:105%"><o:p> </o:p></p>
<p class="MsoNormal" style="line-height:105%"><span lang="EN">CISA also worked with the FCISO Council to finalize the
</span><a name="_Hlk83377008"></a><a href="https://www.cisa.gov/publication/tic-30-core-guidance-documents"><span style="mso-bookmark:_Hlk83377008"><span lang="EN">Pilot Process Handbook</span></span><span style="mso-bookmark:_Hlk83377008"></span></a><span style="mso-bookmark:_Hlk83377008"></span><span lang="EN">.
The handbook describes the process by which agencies will conduct TIC 3.0 pilots, in accordance with OMB Memorandum M-19-26.
<o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:105%"><span lang="EN"><o:p> </o:p></span></p>
<p class="MsoNormal" style="line-height:105%">CISA continues to work with agencies to support TIC pilots and to guide industry in developing TIC overlays. CISA is also actively working to develop the Cloud Use Case, as outlined in
<a href="https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf">M-19-26</a>, and plans to release the draft later this year. Please reference the
<a href="http://www.cisa.gov/trusted-internet-connections">TIC page</a> for updates and additional information on the TIC program.
<o:p></o:p></p>
<p class="MsoNormal" style="line-height:105%"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b><span style="color:#1F497D">Theresa A. Masse<o:p></o:p></span></b></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Cyber Security Advisor, Region 10 (Oregon)
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Cybersecurity and Infrastructure Security Agency<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Department of Homeland Security<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Phone: (503) 930-5671
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Email:</span><span style="font-size:10.0pt;color:#777777">
</span><a href="mailto:theresa.masse@cisa.dhs.gov"><span style="font-size:10.0pt">theresa.masse@cisa.dhs.gov</span></a><u><span style="font-size:10.0pt;color:#0760C1"><o:p></o:p></span></u></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><img border="0" width="97" height="97" style="width:1.0138in;height:1.0138in" id="Picture_x0020_1" src="cid:image002.png@01D7BC14.D87B5C50"><span style="color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="line-height:105%"><o:p> </o:p></p>
</div>
</body>
</html>