By John Sakellariadis

— The Trump administration is officially taking over today. It likely won’t be long before they show their cards on a few key aspects of D.C. cyber policy.

HAPPY MONDAY, and welcome to MORNING CYBERSECURITY! The NFL playoffs were good. “Severance” was better.

Follow POLITICO’s cybersecurity team on X at @rosieperper, @johnnysaks130 and @magmill95, or reach out via email or text for tips. You can also follow @POLITICOPro on X.

Want to receive this newsletter every weekday? Subscribe to POLITICO Pro. You’ll also receive daily policy news and other intelligence you need to act on the day’s biggest stories.

Power shifts, razor-thin margins, and a high-stakes agenda. We’ve transformed our coverage—more reporters, more timely insights, and unmatched policy scoops. From leadership offices to committee rooms, caucus meetings, and beyond, our expert reporting keeps you ahead of the decisions that matter. Subscribe to our Inside Congress newsletter today.

Donald Trump is inaugurated as the 47th President of the United States.

TRUMP 2.0 — After his swearing in this morning, Donald Trump will start unveiling his cyber policy agenda — and in all likelihood, tearing down parts of Joe Biden’s.

Here are some big policy questions to watch, as the new administration takes the reins:

— Tick tock on TikTok: Just 24 hours after America’s favorite Chinese-made short-form video app was banned under U.S. law, in came a new President who wants to save it. The only question is how.

Trump said Sunday he will likely grant a short-term extension for the app later today. But he could still pivot, especially given some senators’ resistance to that idea. And longer term options — such as sale, possibly even to “First Buddy Elon Musk” — still need to be hashed out.

— Into the Typhoon: Incoming Trump administration officials and their GOP allies in Congress have talked a big game about taking the cyber fight to China, which has been eating Uncle Sam’s cyber lunch for several years now. Does their bark have any bite? And how public will they be about it once in office, given the many shortcomings of deterrence by hacking back?

— Scrapping the EOs: Senior Biden administration officials argue the executive order on cybersecurity they unveiled last week is chock-full of savvy, non-partisan cyber guidance for Trump’s .gov. Will the new commander-in-chief pick up what the Biden administration is putting down?

There’s nothing clearly tech- or cyber-related in the imminent orders Trump aides previewed to Congressional GOP leadership Sunday. But some of those aren’t yet final, and the aides didn’t mention Biden’s major EO on artificial intelligence, which the Trump team previously said it wants to scrap.

— The fate of CSRB: There’s no word on whether Trump and his incoming national security team want to eliminate the Cyber Safety Review Board, the after-action review panel Biden stood up to probe what really went wrong after major hacks. Still, Trump could axe some of the special government employees Biden placed on it.

Those experts — which include former CISA Director Chris Krebs, who Trump fired for rebutting his election lies in 2020 — have a term that runs well beyond Jan. 20.

— Are mandates on the outs: It shouldn’t take long for Trump to give some indication of how much his team wants to unwind two cornerstones of Biden’s cyber legacy: the idea that modern cyber threats are so great that the federal government must require private companies to up their defenses — and that software providers need to take on the security burden of their customers.

Republicans and key Trump allies aren’t publicly hell-bent on tearing down Biden’s tougher, mandate-driven approach, as far as this author can tell. But they clearly think the ex-POTUS went too far in some areas and that Trump will be better served focusing his attention on others.

It all begs the question: Is the “voluntary era” of critical infrastructure cyber defense poised for a comeback?

WHO’S IN CHARGE — Former senior Trump cyber and IT official Karen Evans has been tapped for a senior role at CISA while the incoming administration irons out its agency leadership team, according to three people familiar with the personnel move.

Evans, who previously served as DHS’ chief information officer and an assistant secretary in the Energy Department’s cybersecurity and energy security office, will be CISA’s executive assistant director for cybersecurity — at least for the near-term, said the three people, who were granted anonymity to speak about the move before it was announced.

The Trump transition did not respond to a request for comment on Evans’ appointment.

The short game: The move will temporarily make Evans the highest ranking political appointee at CISA. Her role is technically fifth in line at the agency, according to an agency succession plan shared with MC, but all but one of those are now vacant.

The outlier is CISA Executive Director Bridget Bean, the agency’s senior career official, who will become the agency’s acting director.

And the long game: Evans is currently on the agency’s landing team and boasts the most cyber expertise, making her an easy pick to quickly slot into the new role. Longer term, she will likely be nominated for an undersecretary role at DHS, the three people said.

In the meantime, the Trump transition team is racing to fill the CISA deputy director position — a post that is senior to Bean’s and does not require Senate confirmation, the three people said.

That individual would effectively helm CISA until a director is confirmed, which could take months. (POLITICO previously reported the administration is eying former DOE and NSC cyber official Sean Plankey for the director role.)

RAN OUT THE CLOCK — In theory, the Biden administration’s Health and Human Services Department was all-on-board with mandating new cybersecurity protections for the nation’s hospitals.

In practice, maybe not so much.

Not our problem: Biden’s HHS team has officially left office without releasing a long-promised rule to require swathes of hospitals that participate in Medicare and Medicaid to implement a set of 10 baseline cybersecurity measures.

As recently as Tuesday, spokespeople for now-former HHS Secretary Xavier Becerra told your MC host the rule “is in process with HHS’ full support.” That answer came in response to allegations from two other people closely involved in the policy process that Becerra was blocking the rule — and had been, for months.

Why they were worked up: Those two people argued the new mandates were sorely needed to protect the country’s health care system from an onslaught of state-backed and cybercriminal attacks.

“Hospitals across the U.S. have been forced to cancel critical procedures over the last year due to ransomware attacks,” one of those people, a senior administration official, told MC.

The HHS case: HHS spokespeople never replied to multiple requests for comment about the reasons for their delay. But other department efforts to boost cybersecurity in the sector — like a revision to a flagship health data privacy rule — drew pushback from the health care industry, which described them as a hefty burden for already cash-strapped health care organizations.

What’s next: The senior administration official told MC they turned the rule over to the Trump team. It’s unclear how supportive the new president will be.

Food for thought on TikTok:

X

SECURE BY DESIGN’S FUTURE — An outgoing CISA official makes his case for the agency’s secure by design initiative, CyberScoop’s Tim Starks reports.

PARTING SHOT — The Treasury Department on Friday slapped sanctions on a hacker and a company it alleges supported China’s intelligence services in breaching its networks, your MC host reported.

DOWNSIZING? — Kristi Noem, Trump’s pick to head DHS, signaled in her confirmation hearing Friday that she supports trimming CISA’s budget and helping Congressional Republicans end its disinformation efforts, your MC host reported.

Chat soon.

Stay in touch with the whole team: Rosie Perper (rperper@politico.com); John Sakellariadis (jsakellariadis@politico.com); and Maggie Miller (mmiller@politico.com).

New Year. New Washington. New Playbook. With intensified congressional coverage and even faster delivery of policy scoops, POLITICO’s reimagined Playbook Newsletter ensures you’re always ahead of the conversation. Sign up today.

Follow us on Twitter

Heidi Vogt @HeidiVogt Maggie Miller @magmill95 John Sakellariadis @johnnysaks130

Follow us

To change your alert settings, please log in at https://login.politico.com/?redirect=https%3A%2F%2Fwww.politico.com/settings

This email was sent to npkvdejmf6@podam.pl by: POLITICO, LLC 1000 Wilson Blvd. Arlington, VA, 22209, USA

Unsubscribe | Privacy Policy | Terms of Service