Implementing PaC involves secure coding, robust access strategies, automated testing, continuous monitoring, and regulatory compliance.

Additional guidance at https://udx.io/guidance

View Guidance

Leveraging Security in a Platform-as-Code Universe

The White House Office of Management and Budget is instructing agencies to consider reducing staff for programs that have a lapse in funding in the event of a government shutdown, as tensions rise ahead of the Sept. 30 end to the fiscal year. “With respect to those Federal programs whose funding would lapse and which are otherwise unfunded, such programs are no longer statutorily required to be carried out,” the undated message said. The guidance goes on to say that consistent with applicable law, including a federal reduction in force statute, agencies are directed to use this opportunity to consider RIF notices for employees working in projects, programs or activities that have a funding lapse on Oct.1, don’t have another source of funding, and are not consistent with President Donald Trump’s priorities. The project, program or activity must meet all three criteria, the message said. The message places blame for a possible shutdown squarely on congressional Democrats, calling their demands “insane.” The OMB message explains that the One Big Beautiful Bill Act, legislation passed earlier this year that is at the heart of Trump’s second-term agenda, provided “ample resources to ensure that many core Trump Administration priorities will continue uninterrupted.”

Federal cyber authorities sounded a rare alarm last week, issuing an emergency directive about an ongoing and widespread attack spree involving actively exploited zero-day vulnerabilities affecting Cisco firewalls. Cisco said it began investigating attacks on multiple government agencies linked to the state-sponsored campaign in May. The vendor, which attributes the attacks to the same threat group behind an early 2024 campaign targeting Cisco devices it dubbed “ArcaneDoor,” said the new zero-days were exploited to “implant malware, execute commands, and potentially exfiltrate data from the compromised devices.” Cisco disclosed three vulnerabilities affecting its Adaptive Security Appliances — CVE-2025-20333, CVE-2025-20363 and CVE-2025-20362 — but said “evidence collected strongly indicates CVE-2025-20333 and CVE-2025-20362 were used by the attacker in the current attack campaign.” The Cybersecurity and Infrastructure Security Agency said those two zero-days pose an “unacceptable risk” to federal agencies and require immediate action.

The Daily Scoop Podcast is available every Monday-Friday afternoon.

If you want to hear more of the latest from Washington, subscribe to The Daily Scoop Podcast  on Apple Podcasts, Soundcloud, Spotify and YouTube.

White House directs agencies to consider staff reductions in case of shutdown

As the federal government races to adopt AI, many agencies are looking to buy and build the same exact solutions. Recognizing this, the General Services Administration earlier this year launched USAi, a platform that offers agencies access to leading commercial AI models that they can deploy in a streamlined manner, eliminating redundancy across government and leading to greater efficiencies at scale. Zach Whitman, chief data scientist and chief AI officer for the GSA, recently joined me for a discussion at the Agentic AI Government Summit and Jamfest in Washington, D.C., to highlight the USAi effort, how it’s progressing, the challenges GSA faces and what’s next.

The Department of Health and Human Services has tapped DOGE affiliate Zachary Terrell to be its chief technology officer, sources told FedScoop. Terrell’s CTO title was confirmed by three officials, who were granted anonymity to be more candid. Taking on the role of CTO comes after his involvement in Department of Government Efficiency work at both HHS and the National Science Foundation, including the cancellation of grants at the science agency.  One of those sources told FedScoop that Terrell has been in the technology chief role since the beginning of this month and is still at the NSF as well. While his leadership role is new, Terrell has previously been involved in work at HHS, including as a member of the department’s DOGE team, according to a recent legal filing by the government. Per that document, Terrell was listed as one of the 10 team members given access to at least one sensitive system as part of the DOGE work. Specifically, Terrell was one of five team members who weren’t directly employed by the U.S. DOGE Service — the White House home for the group.

Congress is poised to make yet another run at legislation to reform agency software purchasing practices, with the reintroduction in the House last week of the Strengthening Agency Management and Oversight of Software Assets Act. The SAMOSA Act, which passed the House last December, would require federal agencies to comprehensively assess their software licensing practices, a move aimed at curbing duplicative tech, streamlining future purchases and reducing IT costs. Rep. Nancy Mace, R-S.C., chair of the House Oversight Subcommittee on Cybersecurity, Information Technology, and Government Innovation, said in a press release: “The GAO has found the federal government spends more than $100 billion annually on information technology and cybersecurity, including software licenses. Far too often, taxpayer dollars are wasted on these systems and licenses agencies fail to use.” The SAMOSA Act, Mace goes on to say, “requires agencies to account for existing software assets and consolidate purchases: reducing redundancy, increasing accountability, and saving potentially billions for American taxpayers.” 

Also in this episode: Salesforce Global Digital Transformation Executive Nadia Hansen joins SNG host Wyatt Kash in a sponsored podcast discussion on how Agentic AI is reshaping the way government teams work and why agencies need top-level sponsorship, transparent governance and workforce training to realize its potential. This segment was by sponsored by Salesforce.

The Daily Scoop Podcast is available every Monday-Friday afternoon.
If you want to hear more of the latest from Washington, subscribe to The Daily Scoop Podcast  on Apple Podcasts, Soundcloud, Spotify and YouTube.

Inside GSA’s rollout of USAi

It’s Oct. 1 and Congress has failed to pass appropriations for fiscal year 2026. And you know what that means: the federal government has shut down. For the first time since 2019, also during a Trump administration, federal appropriations have lapsed, resulting in furloughs for hundreds of thousands of federal employees and contractors and the halting of many agency operations. Only “excepted employees” and federal workers who are “exempt” from furlough may perform work until the current lapse in appropriations is over. Though Washington has experienced a number of shutdowns and shutdown threats in recent memory, the politically combative climate surrounding this one is much more amplified. The Trump administration has already threatened to use the shutdown to permanently cut jobs that aren’t aligned with the president’s agenda. And so far, neither party seems willing to budge, with many pundits speculating the lapse could drag on long-term without an agreement between Republicans — who control both houses in Congress and the White House — and Democrats. But one thing is clear: Until that agreement is reached, many of the federal government’s most important missions will operate at less than full capacity, including in areas like cybersecurity. FedScoop will keep you informed as the battle around the shutdown continues.

The Trump administration’s sweeping U.S. military shakeup is expected to gain momentum in the months to come — with more leadership changes, major acquisition updates and possible personnel cuts in the Pentagon’s pipeline, Defense Secretary Pete Hegseth suggested during an unusual gathering of military brass Tuesday. At the “key leaders all-call” meeting with hundreds of top generals and admirals summoned from around the world at Marine Corps Base Quantico, Hegseth and President Donald Trump unveiled a broad docket of new and forthcoming directives meant to reflect their overarching vision for “woke”-ending reforms. Trump said: “We will not be politically correct when it comes to defending American freedom. We will be a fighting and winning machine. We want to fight, we want to win, and we want to fight as little as possible.” Theories swirled about the intent behind this mass gathering after Hegseth hastily ordered it last week. In the portion that was publicly livestreamed, Hegseth outlined his plans for policy shifts — via 10 directives — around physical fitness and grooming standards, mandatory training, oversight processes, records retention rules and more.

The Daily Scoop Podcast is available every Monday-Friday afternoon.

If you want to hear more of the latest from Washington, subscribe to The Daily Scoop Podcast  on Apple Podcasts, Soundcloud, Spotify and YouTube.

The federal government shuts down; Takeaways from Hegseth’s meeting with the military’s top brass

It’s day two of the federal shutdown, and with the Senate on leave, there won’t be any sort of appropriations deal until Friday at the earliest — though many have doubts about that possibility. As federal agencies adjust to the new normal with hundreds of thousands of federal employees furloughed and the White House threatening more layoffs targeting those who’ve been sent home, FedScoop took the time to compile a near-complete look at how agency IT organizations are affected. An analysis of the nearly two dozen civilian Chief Financial Officer Act agencies found that some agencies explicitly outlined plans to scale back IT operations amid the shutdown, while others deemed several IT staff members essential for managing technology and cybersecurity infrastructure. For instance, at the Department of Commerce’s Office of the CIO, just one individual is tasked with taking responsibility for shutdown tasks and assurance that the office will continue to work on critical IT functions. If the lapse in funding continues for an extended period, there is also the potential for staff to be recalled on an intermittent or full-time basis for cybersecurity and maintenance work, and limited staff may be called for administrative functions. While at the Labor Department, the Office of the Assistant Secretary for Administration and Management has selected “a minimal IT staff” within the OCIO to oversee tech operations. Those employees are now tasked with managing Labor’s technology services, applications and website, in addition to having other IT security responsibilities that support the agency’s excepted and exempt staff.

A nonprofit legal group is suing a handful of federal agencies, calling on the federal bodies to release documents related to the use of artificial intelligence to carry out the Trump administration’s “deregulation agenda.” The lawsuit, filed by Democracy Forward on Wednesday, asks a court to require the General Services Administration, Office of Personnel Management, Office of Management and Budget and the Department of Housing and Urban Development to comply with public records laws amid concerns over how AI is being used to “weaken” existing federal regulations. Democracy Forward said it reviewed both public records and documents obtained through FOIA requests and found GSA plays a “central role” in the White House’s efforts to overhaul regulations. The nonprofit cited an apparent email trail, in which a GSA-affiliated email informs other agencies of “significant progress” in reviewing its internal and external policies to ensure consistency with President Donald Trump’s directives. The suit further pointed to reports of an AI tool called SweetREX developed by an affiliate of the Department of Government Efficiency.

The Daily Scoop Podcast is available every Monday-Friday afternoon.

If you want to hear more of the latest from Washington, subscribe to The Daily Scoop Podcast  on Apple Podcasts, Soundcloud, Spotify and YouTube.

How federal IT shops are continuing work during the shutdown

Former State Department employees whose roles were eliminated as part of a reduction-in-force still received information about whether they would be needed during the government shutdown — including some workers who were told their positions were “excepted.” While the full extent of the issue wasn’t immediately clear, three such employees shared those notifications with FedScoop on the condition of anonymity for fear of retaliation. Others were also aware of the problem even if they didn’t receive the messages themselves.  In response to a FedScoop request for comment, a State spokesperson indicated the department was aware of the issue and had taken steps to address it, confirming there were “minor” discrepancies with data, saying that the department immediately worked to resolve any outstanding issues. Of the three State Department notices reviewed by FedScoop, one informed the RIF’d employee that their position was “excepted” and explained that those roles are defined as those needed for emergencies that threaten life and property or are essential for national security. It then ordered that worker to “report to work on your next regularly scheduled workday.” The other two already RIF’d employees were told that they would be furloughed during the shutdown but that it was “in no way a value judgement on the work you do for the Department.” Those employees were also instructed to review their department emails for updates despite not being able to access that information. Of the three RIF’d employees, only one — a foreign service officer — is still on the department’s payroll.

As employees at the Education Department prepared for a looming government shutdown this week, several set an automatic email reply to inform others of their furloughed status. But by Thursday morning, some furloughed workers discovered that their automatic email replies had been altered, without their knowledge, to include a message blaming Democratic senators for the ongoing government shutdown. According to two furloughed Education Department employees, the agency sent workers suggested language to use for their out-of-office messages earlier this week, but the language was “neutral” regarding the shutdown.  One of the employees, speaking on the condition of anonymity, told FedScoop they and other furloughed staff mostly cut and paste from the suggested language with little to no changes when setting their automatic replies. But when they checked their automatic email replies Thursday morning, the message changed and included partisan language mentioning Democrats, the employee said. The other furloughed worker said they set the generic text for their OOO email Wednesday morning and the message was changed by Wednesday night.

The Daily Scoop Podcast is available every Monday-Friday afternoon.
If you want to hear more of the latest from Washington, subscribe to The Daily Scoop Podcast  on Apple Podcasts, Soundcloud, Spotify and YouTube.

RIF’d State Department workers get confusing furlough messages;  Education workers' automatic email replies changed to blame shutdown on Democrats

Defense Secretary Pete Hegseth issued a new edict last week to reduce the time personnel spend on cybersecurity training, among other reforms. The directive came in a Sept. 30 memo to senior Pentagon leadership and DOD agency and field activity directors, ordering the military departments, in coordination with the Pentagon’s chief information officer, to “Relax the mandatory frequency for Cybersecurity training.” Hegseth also called for narrowly tailoring records management training to service member roles and allowing flexibility in training delivery, as well as automating information management systems to eliminate training requirements. Additionally, Hegseth directed the military departments and other Pentagon leaders to “relax” the mandatory frequency for controlled unclassified information (CUI) training; remove Privacy Act Training from the Common Military Training (CMT) list; eliminate the mandatory frequency for “Combating Trafficking in Persons” refresher training after appropriate legislation is enacted; consolidate mandatory training topics, “as appropriate”; and develop an integrated CMT program plan. The changes are to be “implemented expeditiously,” per Hegseth’s directive.

Federal courts are upgrading their cybersecurity on a number of fronts, but multifactor authentication for the system that gives the public access to court data poses “unique challenges,” the Administrative Office of the United States Courts told Sen. Ron Wyden in a letter last week. Wyden, D-Ore., wrote a scathing August letter to the Supreme Court in response to the latest major breach of the federal judiciary’s electronic case filing system. The director of the Administrative Office of the United States Courts responded on behalf of the Supreme Court. It is “simply not the case” that the courts have, in the words of Wyden, “ignored” advice from experts on securing the Case Management/Electronic Case Files (CM/ECF) system, wrote Robert Conrad Jr., director of the office. Conrad wrote in the Sept. 30 letter: “Substantial planning for the modernization effort began in 2022, and we are now approaching the development and implementation phase of the project. We expect implementation will begin in the next two years in a modular and iterative manner.” In recent years, the office has been testing technical components on its modernization effort, and is centralizing the operation of data standards to enable security, Conrad said. 

The Daily Scoop Podcast is available every Monday-Friday afternoon.
If you want to hear more of the latest from Washington, subscribe to The Daily Scoop Podcast  on Apple Podcasts, Soundcloud, Spotify and YouTube.

DOD cuts mandatory cybersecurity training; Federal judiciary touts cyber work after major breach

A federal workers’ union is suing the Education Department after agency employees on furlough or administrative leave discovered that their automatic email replies had been changed to a message blaming Democratic lawmakers for the ongoing government shutdown. The complaint, filed by the American Federation of Government Employees, asks a court to prohibit the Education Department’s alleged efforts to “put political speech in federal employees’ mouths.”  “Forcing civil servants to speak on behalf of the political leadership’s partisan agenda is a blatant violation of federal employees’ First Amendment rights,” the suit stated, adding that “employees are now forced to involuntarily parrot the Trump Administration’s talking points with emails sent out in their names.”  The suit came one day after some furloughed workers discovered that their automatic out-of-office email replies were changed without their knowledge, from neutral language to partisan messaging that blamed Democrats for the shutdown, which began last Wednesday.

Three House Democrats questioned the Department of Homeland Security on Monday over a reported Immigration and Customs Enforcement contract with a spyware provider that they warn potentially “threatens Americans’ freedom of movement and freedom of speech.” Their letter follows publication of a notice that ICE had lifted a stop-work order on a $2 million deal with Israeli spyware company Paragon Solutions, a contract that the Biden administration had frozen one year ago pending a review of its compliance with a spyware executive order. Paragon is the maker of Graphite, and advertises it as having more safeguards than competitors that have received more public and legal scrutiny, such as NSO Group’s Pegasus, a claim researchers have challenged. A report earlier this year found suspected deployments of Graphite in countries across the globe, with targets including journalists and activists. \

The Daily Scoop Podcast is available every Monday-Friday afternoon.
If you want to hear more of the latest from Washington, subscribe to The Daily Scoop Podcast  on Apple Podcasts, Soundcloud, Spotify and YouTube.

Education Department sued over altered shutdown emails; Dems launch probe into ICE spyware contract

The Environmental Protection Agency’s pledge to “get out of the way” on chemical reviews to accelerate the buildout of artificial intelligence data centers doesn’t mean those reviews would be any less “robust,” a top EPA nominee told lawmakers Wednesday. Appearing before the Senate Environment & Public Works Committee, Douglas Troutman — President Donald Trump’s pick for assistant administrator for toxic substances — was pressed by Sen. Ed Markey, D-Mass., about comments made by EPA Administrator Lee Zeldin last month following a White House roundtable with AI and data center leaders. In a Sept. 18 press release, Zeldin announced that the EPA would begin prioritizing the review of new chemicals — under the Toxic Substances Control Act (TSCA) — that would be used in data center projects. Markey asked Troutman, a former chemical industry lobbyist, what provisions in federal toxic safety laws indicate the EPA can “get out of the way of reviewing chemicals for safety.” Troutman responded that “nothing will change with regard to the robust review based on the risk-based statute enacted under Section Five of TSCA.” Markey appeared unconvinced, telling Troutman that if he’s confirmed, he will “be under orders from Administrator Zeldin to get out of the way.” The Massachusetts Democrat made the case that “big tech bosses” with ties to the administration could lean on the agency to bypass regular review protocols.

Voting rights groups are asking a court to block an ongoing Trump administration effort to merge disparate federal and state voter data into a massive citizenship and voter fraud database. Last week, the League of Women Voters, the Electronic Privacy Information Center (EPIC) and five individuals sued the federal government in D.C. District Court, saying it was ignoring decades of federal privacy law to create enormous “national data banks” of personal information on Americans. On Tuesday, the coalition, represented by Democracy Forward Foundation, Citizens for Responsibility and Ethics in Washington (CREW), and Fair Elections Center, asked the court for an emergency injunction to halt the Trump administration’s efforts to transform the Systematic Alien Verification for Entitlements into an immense technological tool to track potential noncitizens registered to vote. Until this year, SAVE was an incomplete and limited federal database meant to track immigrants seeking federal benefits. In an Oct. 7 court filing, the groups said an immediate injunction was needed to prevent permanent privacy harms due to the “illegal and secretive consolidation of millions of Americans’ sensitive personal data across government agencies into centralized data systems” through SAVE. 

The Daily Scoop Podcast is available every Monday-Friday afternoon.
If you want to hear more of the latest from Washington, subscribe to The Daily Scoop Podcast  on Apple Podcasts, Soundcloud, Spotify and YouTube.

EPA nominee: Chemical reviews won’t be compromised for AI data centers; Voting groups fight Trump’s SAVE database overhaul

Federal agencies’ latest status updates on how they’re using artificial intelligence reveal persistent barriers and variability on where agencies stand with ”high-impact” use cases. The release of the 2025 AI compliance plans offers one of the first in-depth glimpses at how federal agencies are addressing issues of AI risk management, technical capacity and workforce readiness under the second Trump administration. Those documents, which were required under the Trump administration’s AI governance memo to agencies, were supposed to be released publicly by Sept. 30. As of publication time, FedScoop located roughly 20 plans and 14 strategies across 22 agencies. For nine of the roughly two dozen Chief Financial Officers Act agencies, FedScoop was unable to find either a plan or a strategy. The U.S. Department of Agriculture and the Nuclear Regulatory Commission, meanwhile, produced only strategies. FedScoop and DefenseScoop attempted to contact the CFO Act agencies that didn’t produce both documents, but the agencies either didn’t respond or didn’t provide the documents. Two of those agencies, NASA and the Justice Department, noted the government shutdown in their responses, and both the DOJ and Department of Defense indicated they were working to post at a later date. Agencies were also required to submit AI strategies for the first time this year. Those documents contain some of the same information as the compliance documents, including plans to train the workforce, examples of use cases, and systems for governance. The compliance plans, meanwhile, which are in their second year, have changed only slightly from their previous iterations, with some agencies showing progress on their implementation of the technology and risk management practices.

A top Senate Democrat introduced legislation Thursday to extend and rename an expired information-sharing law, and make it retroactive to cover the lapse that began Oct. 1. Michigan Sen. Gary Peters, the ranking member of the Homeland Security and Governmental Affairs Committee, introduced the Protecting America from Cyber Threats (PACT) Act, to replace the expired Cybersecurity and Information Sharing Act of 2015 (CISA 2015) that has provided liability protections for organizations that share cyber threat data with each other and the federal government. Industry groups and cyber professionals have called those protections vital, sometimes describing the 2015 law as the most successful cyber legislation ever passed. The 2015 law shares an acronym with the Cybersecurity and Infrastructure Security Agency, which some Republicans — including the chairman of Peters’ panel, Rand Paul of Kentucky — have accused of engaging in social media censorship. As CISA 2015 has lapsed and Peters has tried to renew it, “some people think that’s a reauthorization of the agency,” Peters told reporters Thursday in explaining the new bill name. 

The Daily Scoop Podcast is available every Monday-Friday afternoon.
If you want to hear more of the latest from Washington, subscribe to The Daily Scoop Podcast  on Apple Podcasts, Soundcloud, Spotify and YouTube.


How federal agencies are tackling AI use under Trump; Another attempt to extend CISA 2015 law

Insights and discussions from Usability Dynamics on cybersecurity, cloud automation, and the future of the web.

Leveraging Security in a Platform-as-Code Universe

UDX

Related tracks