Chris DeRusha, the federal chief information security officer (CISO), is stepping down after more than three years in the role, the Office of Management and Budget (OMB) confirmed. Mike Duffy, the associate director for capacity building in the cyber division at the Cybersecurity and Infrastructure Security Agency (CISA) within the Department of Homeland Security, will take over as acting federal CISO.
DeRusha joined OMB in January 2021, following his work on the Biden presidential campaign. His extensive experience includes serving as CISO for the state of Michigan, five years at DHS, and two years as a senior cyber advisor for the White House.
During his tenure, DeRusha was instrumental in advancing several key White House cyber priorities. He played a pivotal role in crafting and implementing the zero trust strategy and overseeing the federal agency responsibilities outlined in President Joe Biden’s cyber executive order. His efforts were particularly focused on software security and the adoption of phishing-resistant multi-factor authentication.
Ross Nodurft, executive director of the Alliance for Digital Innovation (ADI) and former OMB cyber chief, praised DeRusha’s impact. “Chris DeRusha, his teams at OMB and ONCD, and his partners at CISA and across the CISO community have made significant strides in making our federal government more secure and resilient. Chris has guided federal agencies into security postures and architectures that are ahead of many commercial companies,” Nodurft said. “He has driven governance processes that prioritize risk management and helped make cybersecurity a consideration in the beginning of technology decisions as opposed to a bolted-on afterthought. The government will miss his leadership, energy, and vision. ADI is thankful that Mike Duffy will be stepping in to keep up the drumbeat of cybersecurity and zero trust implementation and modernization.”
At CISA, Duffy’s responsibilities will be temporarily handed over to Shelly Hartshook, the deputy associate director. During his time at CISA, Duffy has managed significant priorities, including modernizing the continuous diagnostics and mitigation (CDM) program, helping agencies implement the zero trust maturity model, and advancing several cyber shared services for agencies.
Former DHS Under Secretary & Chief Acquisition Officer Chris Cummiskey shared his thoughts on LinkedIn: “Congratulations to my friend and former colleague Chris DeRusha as he prepares to leave the White House after a successful 3 1/2 year tenure as the Federal Chief Information Security Officer. Chris started out at DHS helping to build the department’s cybersecurity capabilities that would eventually become CISA. As the Federal CISO and a Deputy Director at ONCD, he has led the charge on issues like Zero Trust and software security. An equally talented leader, Michael Duffy, the Associate Director for Capacity Building at CISA, will take over as interim Federal CISO next week. Best wishes with the next chapter, Chris!”