ACT-IAC: Proposals to Modernize the Federal CISO Handbook into a Web-Based Playbook

In two minutes

• The paper recommends turning the Federal CISO Handbook from a static PDF of 100+ pages into a web-first, community-driven "Operational Playbook" (p. 4, Proposal 1).
• It says the 2019 handbook predates mature Zero Trust, AI Executive Orders and the move to continuous monitoring (p. 4).
• Proposal 1 would host a living wiki or GitBook-style site on CIO.gov, with pinned "Flash Updates" for new Executive Orders or Binding Operational Directives, automated link checks, and downloadable templates such as POA&M trackers and incident response playbooks (pp. 4-5).
• Proposal 2, "CISO as Leader", adds a first-100-days onboarding appendix, guidance on managing up, across and out, and says the Agency Head ultimately owns the agency's risk posture (p. 5).
• Proposal 3, "CISO as Architect", covers Zero Trust, AI, quantum-resistant encryption, supply chain risk, and a move from three-year ATOs to Continuous Authorization. It cites OMB M-26-05, NIST SP 800-161 and SP 800-160 (p. 6).
• Proposal 4, "CISO as Steward", covers funding sources (appropriations, TMF, CDM), free CISA, GSA and OPM services, NICE Framework workforce planning, skills-based hiring under OMB M-24-14, and contract labor oversight (pp. 6-7).
• The paper asks the CISO Council to concur, name an Executive Sponsor, resource a drafting team and name an Agency Sponsor (p. 7).
• The paper states it gives recommendations and is not the updated handbook (p. 4).

Key numbers

• 100+ pages: Length of the current static PDF handbook that would be replaced (p. 4).
• 2019: Year of the previous handbook version (p. 4).
• Three-year: Traditional ATO "snapshot" cycle the handbook would move away from toward Continuous Authorization (p. 6).
• January 2026: Adoption of OMB M-26-05, which the handbook would reflect when replacing rescinded software supply chain mandates (p. 6).
• 4: Strategic proposals: content delivery, leader, architect, steward (p. 4).
• 4: Recommended next-step actions for the CISO Council (p. 7).

What to do with it

• Use the Proposal 2 outline (first 100 days, managing up, across and out) as a checklist for onboarding a new CISO (p. 5).
• Follow the paper's point that risk tolerance is set at the organizational level: define what you escalate to your Enterprise Risk Management Council or equivalent (p. 5).
• Review your ATO process against the proposed move to Continuous Authorization with automated evidence collection (p. 6).
• Check your supply chain approach against the paper's risk-based direction, which cites NIST SP 800-161, SBOMs and OMB M-26-05 (p. 6).
• Map funding options named in Proposal 4 (appropriations, TMF, CDM, free CISA, GSA and OPM services) to your budget requests (p. 6).
• Anchor workforce planning to the NICE Framework (NIST SP 800-181 Rev. 1) and review skills-based hiring and Direct Hire use (p. 7).

Read the full document if

• you sit on or advise the Federal CISO Council and must decide on the handbook update.
• you are a new or aspiring federal CISO and want to know what topics the next handbook will cover.
• you want a short list of federal policy references (OMB M-26-05, M-24-14, NIST SP 800-161, 800-160, 800-181) tied to CISO work.

What it relies on

="The paper rests on the views of a volunteer group of government and industry authors, listed on p. 8, several of them current or former Federal CISOs. It states that it uses the ACT-IAC consensus-based collaborative process (p. 2). It presents no survey, dataset or method, and it supports its claims about the old handbook with stated experience (p. 4). It cites OMB and NIST documents by name without detail. ACT-IAC is a non-profit that says it does not endorse any product or vendor (p. 2). Authors on p. 8 include staff from companies such as Palo Alto Networks, CGI Federal and Armis from ServiceNow, and ACT-IAC offers to help build the handbook (p. 7).

Our read

A proposal, not a handbook. It is useful for seeing what the next federal CISO handbook is meant to cover and which OMB and NIST references it will lean on. It gives no data on outcomes. Readers outside the federal government will find the policy references most relevant to federal work.