May 20th Daily Policy Monitoring

MAY 19 – GSA: GSA and Salesforce Collaboration Cuts Costs for Government, Slack to Provide Real-Time AI-Powered Efficiency

• The U.S. General Services Administration (GSA) announced another cost-saving OneGov agreement.
• GSA and Salesforce have teamed up to lower the price of Slack, which is used to bring together people, apps, data processes, and AI agents.
• Through this agreement, Salesforce will offer Slack Enterprise Grid, a collaboration solution for large, complex organizations that offer enterprise-grade security, scalability, and centralized administrative control.
• The agreement sets pricing based on total government purchasing volume, replacing lower, fragmented discounts from individual agency deals. This model reflects GSA’s central role in procurement, maximizing cost savings, reducing redundancy, and streamlining IT acquisition with consistent pricing across the federal government.
• The partnership has set a temporary price reduction of 90% and almost 70% off per user on Slack AI for Enterprise to every federal agency. The price reductions are in effect through November 30, 2025.

MAY 19 – CISA: CISA Welcomes Madhu Gottumukkala as New Deputy Director

• The Cybersecurity and Infrastructure Security Agency (CISA) has announced the appointment of Madhu Gottumukkala as its new Deputy Director.
• In this role, he will help lead CISA’s mission to understand, manage, and reduce risk to cyber and physical infrastructure.
• Prior to his appointment as the CISA Deputy Director, Dr. Gottumukkala served as Commissioner and Chief Information Officer for South Dakota’s Bureau of Information and Technology, overseeing statewide technology and cybersecurity initiatives.
• Dr. Gottumukkala holds a PhD in Information Systems from Dakota State University, an MBA in Engineering and Technology Management from the University of Dallas, an M.S. in Computer Science from the University of Texas at Arlington, and a B.E. in Electronics and Communication Engineering from Andhra University.

MAY 13 – NIST: Foundational Cybersecurity Activities for IoT Product Manufacturers

• The National Institute of Standards and Technology (NIST) has published its updates to NIST Internal Report 8259 on Foundational Cybersecurity Activities for IoT Product Manufacturers.
• This document describes recommended activities related to cybersecurity for manufacturers, spanning pre-market and post-market, to help them develop products that meet their customers’ needs and expectations for cybersecurity.
• Updates to the report were discussed in a March 2025 “Workshop on Foundational Cybersecurity Activities for IoT Device Manufacturers,” and an earlier event held in December 2024 titled “Workshop on Updating Manufacturer Guidance for Securable Connected Product Development.”
• The revision also describes seven recommended foundational cybersecurity activities that manufacturers should consider improving for securability of their IoT products. Four of the activities primarily impact decisions and actions performed by the manufacturer before a product is sent out (pre-market), and the remaining three activities primarily impact decisions and actions performed by the manufacturer acter the product sale (post-market). 
• Comments are due by July 14, 2025.

May 19th Daily Policy Monitoring

MAY 19 – DHS S&T: DHS S&T Released New Tool to Strengthen Global Navigation Satellite Systems for Critical Infrastructure

• The Department of Homeland Security (DHS) Science and Technology Directorate (S&T) launched a new resource on GitHub to help safeguard critical infrastructure.
• PNT systems rely on accurate Global Navigation Satellite System (GNSS) signals to function properly. If these signals are disrupted, critical services could be impacted. To address this risk, the GNSS Test Vector Suite and Distribution Methodology provides critical infrastructure owners and operators the tools to independently identify and define appropriate test scenarios that support conformity assessments, to help evaluate and improve the resilience of their systems.
• GNSS Test Vector Suite includes a standardized set of test scenarios and tools that allow developers and testers to assess how well their equipment can handle challenges like signal interference or spoofing attempts.
• The process works as follows: GNSS Test Vector Suite generates simulated data, the data is converted into signals that mimic real-world GNSS systems, these signals are fed into designated GNSS devices or other PNT equipment, enabling users to evaluate how their systems respond to simulated disruptions.
• The GNSS Test Vector Suite and Distribution Methodology supports Executive Order 13905, which aims to protect essential Positioning, Navigation and Timing (PNT) systems used in industries like energy, transportation and telecommunications.

MAY 19 – GAO: Artificial Intelligence Use and Oversight in Financial Services

• The US Government Accountability Office (GAO) has released a report on the use of artificial intelligence in the financial services sector.
• This report reviews the benefits and risks of AI use in financial services, federal financial regulators’ oversight of AI use in financial services, and regulators’ AI use in their supervisory market oversight activities.
• The GAO reviewed studies by federal agencies, academics, industry, and other groups; examined documentation and guidance from federal financial regulators; and interviewed regulators, consumer and industry groups, researchers, financial institutions, and technology providers to produce this report.
• The GAO identified that while AI is benefitting areas such as automated trading, credit decisions, and customer service, AI can pose risks including potentially biased lending decisions, data quality issues, privacy concerns, and new cybersecurity threats.
• The GAO recommends that Congress consider granting the National Credit Union Administration (NCUA) authority to examine technology service providers for credit unions. GAO also recommends that NCUA update its model risk management guidance to encompass a broader variety of models used by credit unions.

MAY 19 – FS-ISAC: FS-ISAC Releases Finding from Annual Report on Cyber Threats and Trends

• The FS-ISAC has released the findings from its annual report on cyber threats and trends, titled Navigating Cyber 2025.
• The report highlights the top cyber threats challenging the financial services sector today, including surging fraud and scams enabled by generative AI, attacks on suppliers that impact critical operations, more opportunities for threat actors to exploit geopolitical and economic conflict and uncertainty, and the increasing sophistication of attacks like distributed denial of service (DDoS) attacks and ransomware.
• The FS-ISAC recommends that firms adopt a cryptographically agile approach to address the migration to quantum-resilient cryptography algorithms.
• The Navigating Cyber 2025 report is sourced from FS-ISAC’s more than 5,000 financial firm members in 75 countries and further augmented by analysis by the Global Intelligence Office.

MAY 15 – ENISA: ENISA Handbook on Cyber Stress Testing

• The European Union Agency for Cybersecurity (ENISA) has released a handbook to provide guidance for national or sectorial authorities overseeing cybersecurity and resilience of critical sectors at the national, regional, or EU level under NIS 2 Directive.
• The handbook provides the definition of a cyber stress test as “a targeted assessment of the resilience of individual organizations and their ability to withstand and recover from significant cybersecurity incidents, ensuring the provision of critical services, in different risk scenarios.”
• The handbook provides a step-by-step guide for cyber stress testing, outlines how tests can be suitable for assessing resilience, dependencies and systemic risks, and explains how they can be conducted at the national, regional, and EU level.
• The handbook further offers recommendations at each step of the process, including how decisions on the number and type of entities tested can affect the results and complexity of the test, as well as tips regarding scenario development and the use of resilience metrics to identify gaps and issues at both entity and sector level.

MAY 15 – Commerce: UAE/US Framework on Advanced Technology Cooperation

• The US Department of Commerce, in partnership with the UAE, has established the “US-UAE AI Acceleration Partnership,” to bolster cooperation around critical technologies and ensure the protection of such technologies on a set of joint commitments.
• As part of the partnership, the US and UAE have also unveiled a new AI campus in Abu Dhabi which will include 5GW of capacity for AI data centers and provide a regional platform from which US hyperscalers will be able to offer latency-friendly services to nearly half of the global population living within 3,200 km of the UAE.
• The campus will be built by G42 and operated in partnership with several US companies.
• As part of the UAE investment program in digital infrastructure in the US, the UAE and US governments will work together to make the process of inward investments into the US by UAE Investment Funds more efficient.
• Within 30 days of the agreement, the US and UAE will establish a working group to implement, monitor, and assess progress.

MAY 15 – Army: Army Launches Army Enterprise LLM Workspace

• The Army has launched the Army Enterprise Large Language Model workspace, which is a generative AI platform that showcases how the army is harnessing cutting edge artificial intelligence to streamline communication, enhance operational efficiency, and drive innovation.
• The platform has been used to tackle tasks such as reclassifying personnel descriptions.
• The platform includes features such as: CUI accreditation to ensure compliance with security standards, Ask Sage generative AI technology, and token-based subscription offerings.
• The platform also utilizes Ask Sage IL5 Software-as-a-Service, which is hosted within Army’s cArmy Cloud. This capability lowers the barrier to entry, making it accessible to users across the Army enterprise.
• The platform is currently available free for 30 days use for eligible users. The platform leverages technologies such as Azure, OpenAI Gov, Mistral, LLM3A.3.3, AWS Bedrock Gov, Google Gemini, and other open source LLMs.