Although there is more that OMB and the CIO Council can do, information security is primarily the responsibility of individual agencies.
There is more that OMB and the CIO Council can do