As much of the U.S.’s critical infrastructure is owned and operated by the private sector, the administration is urging private companies to take the following steps immediately to protect the critical services:

• Mandate the use of multi-factor authentication on systems to make it harder for attackers to gain access
• Deploy modern security tools on computers and devices to continuously look for and mitigate threats
• Check with cybersecurity professionals to make sure that systems are patched and protected against all known vulnerabilities, and change passwords across networks so that previously stolen credentials are useless to malicious actors
• Back up data and ensure offline backups are beyond the reach of malicious actors;
• Run exercises and drill emergency response plans to be prepared to respond quickly to minimize the impact of any attack
• Encrypt data so it cannot be used if stolen
• Educate employees on common tactics that attackers will use over email or through websites, and encourage them to report if their computers or phones have shown unusual behavior, such as unusual crashes or operating very slowly
• Engage proactively with local Federal Bureau of Investigation (FBI) field office or the Cybersecurity and Infrastructure Security Agency (CISA) Regional Office to establish relationships in advance of any cybersecurity incidents. Please encourage IT and Security leadership to visit the websites of CISA and the FBI, where they will find technical information and other useful resources.

The administration is asking technology and software companies to implement the security practices mandated in the President’s Executive Order, Improving our Nation’s Cybersecurity, and build security into products from the ground up.