A tangled mess: Government rules for social media security lack clarity

The report analyzes the hijacking of the SEC’s X account—conducted via a SIM-swapping attack after multifactor authentication was disabled—and the broader policy ambiguity around securing federal social media accounts. Drawing on responses from multiple agencies, it highlights inconsistent adoption of MFA and phishing-resistant methods, references to EO 14028 and OMB zero trust guidance, unclear authority for OMB/CISA to mandate controls on third-party platforms, and concludes that clearer, enforceable baseline requirements are needed to reduce the risk of market-moving account compromises.