With IT systems so old, modernization becomes more a matter of rewriting code and creating entirely new systems, tasks that can take years and cost billions. But without such a level of effort, those old systems become impossible to secure.
The plan to run the reports through the new Office of American Innovation may help the reporting and subsequent plans become more consistent, and perhaps even base them on best practices. Likewise, the requirement that security plans be consistent with NIST standards may help government systems move past their current status in which they're islands of IT surrounded by moats of unique systems that are impossible to secure.
In addition, the EO's reporting requirements are now consistent with the nature of the data system being evaluated. National security-related systems are now under the purview of the Secretary of Defense and the Director of National Intelligence. Other systems are under the purview of the Department of Homeland Security. What's missing from the EO are directions for the future and, more important, funding.
Without some overall direction, the reporting requirements are simply a look into the past. Without funding, there's no way to implement changes, regardless of how important or well-intentioned they may be. The executive branch does not have the means to pay for its efforts without Congress, and that means that Congress must step up to do its part in cyber-security. Unfortunately, Congress in recent years has been unwilling to spend the money to make federal systems secure.
The result is that the cyber-security plan outlined by the president and his administration has the right intentions, but it's unable to move beyond that without help. That same inability to produce results has been a consistent factor in the poor state of cyber-security in federal IT systems for years.
Without a commitment from all branches of government to move forward, the new EO becomes simply the latest in a long series of unrealized opportunities. The only way to change that is for the president to find a way to get Congress to act. The best way might be for the private sector to convince legislators that their failure to act has major adverse consequences for all of the industry.