Federal employee union lawsuit highlights federal cybersecurity and data protection gaps

A union lawsuit against OMB and OPM alleges inadequate safeguards around centralized federal employee PII, elevating systemic cyber risk and potential noncompliance with FISMA, NIST CSF, and zero trust mandates. Drawing lessons from the 2015 OPM breach and GAO’s continued high-risk designation for federal cybersecurity, it urges CISOs to prioritize fundamentals—encryption, MFA, least privilege, segmentation, logging/monitoring, and exercises—highlighting that governance and execution gaps, not a specific breach, are the central concern.