This policy focus is essential as we continue to uncover and comprehend the impacts of the SolarWinds cyberattack. From bolstering the role of the US Cybersecurity and Infrastructure Security Agency (CISA) to taking critical steps to protect US infrastructure and supply chains to building a pipeline of advanced cybersecurity professionals, these critical policy areas must be central to the nation’s agenda going forward.

The members of the Charter of Trust – an international alliance of corporations and organizations committed to enabling trust in digital technologies – urge US government officials to align their policy priorities with several core principles that emphasize the need to prioritize cybersecurity laws, protections measures and education.

Ownership

Principle One of the Charter of Trust establishes that responsibility for cybersecurity should be appropriately designated throughout an organization with proper accountability in management. Aligned with that principle, we are encouraged by congressional action, via the recently passed National Defense Authorization Act (NDAA), which creates a “National Cyber Director” role within the White House.[1]  We expect this new leadership role will pave the way for improved and streamlined threat intelligence with sharing of information across government agencies and with industry. This same legislation expands the role and responsibilities of CISA, a crucial step in protecting critical infrastructure in the United States. We anticipate that the new US administration will continue to encourage expansion of CISA resources, responsibilities and partnership with the private sector moving forward. These are all positive developments that will strengthen US national security as well as the security of the economy and critical infrastructure. We encourage government leaders at both ends of Pennsylvania Avenue to make cybersecurity an ongoing and sustained policy priority.

Supply Chain Security

Principle Two states that companies and – if necessary – governments must establish risk-based rules beyond the proposed Baseline Cybersecurity Supply Chain Requirements[2] to ensure adequate protection across the digital supply chain. For critical infrastructures such as the US power grid and other critical IoT solutions the Charter of Trust advocates for independent certification in its Principle Seven. As was observed in the recent high-profile SolarWinds attacks, third-party and fourth-party cyber risk management has never been more important. It is imperative for organizations to have visibility into the cybersecurity measures of their key vendors. Aligned to what we’ve developed in our white paper on supply chain security, the Charter of Trust is confident that CISA will continue and expand on its work as the nation’s cyber risk management advisor providing organizations with guidance and frameworks for assessing third-party risk. Tactically, this includes promoting standards across secure software development and engaging in a coordinated, improved approach to vulnerability management.

Education

Principle Six of the Charter calls on academia to expand dedicated cybersecurity courses in school curricula, helping to build a diverse talent base. There is a serious deficit in cyber talent pipeline, in large part due to the lack of educational opportunities. Additionally, there are known challenges in the cybersecurity field to properly identify, recruit and retain talent, especially women and minority groups. Meanwhile, estimates indicate there will be more than three million cybersecurity jobs unfilled just this year[3]. Recognizing the magnitude of the challenge, we encourage the administration to proactively address this shortfall through both creative and traditional means, including adjustments to immigration policy related to high-skilled cyber talent and providing dedicated funding to STEM education, especially in high schools and community colleges.

Security by default

Principle Three of the Charter calls for the adoption of the highest appropriate level of security and data protection, highlighting the need to ensure that security and data protection are preconfigured into the design of products, functionalities, processes, technologies, operations, architectures, and business models.  As industrial production – especially in the technology and mobility sectors – continues to recover in the wake of the pandemic, security by default is now more essential than ever.  We encourage and anticipate further discussion on device-based security standards – including the IoT Security Act of 2020 – when contemplating next steps in crafting more advanced, flexible cybersecurity principles.

International Norms and Leadership

Perhaps the most impactful cybersecurity actions government officials can undertake is to regain and reassert US leadership in cyberspace. We recognize that success will require global support and joint initiatives between industry, governments, academia and research organizations, as laid out in both Principle 10 of our Charter of Trust and its Joint Initiatives and Associate Partner Forum, which support a collaborative approach between these three important stakeholder groups. To also strengthen the global digital supply chain for the US industry harmonization of standards and requirements with other regions shall become a priority of the new administration.

Cybersecurity is at the core of national defense, future stability and economic growth. Its importance should not be underestimated or placed down the list of highest governmental priorities. The members of the Charter of Trust stand by to help inform and support these policy actions.

[1] Congressional backers cite cybersecurity provisions as they push Trump to sign defense bill – CNNPolitics

[2] Charter of Trust Baseline Cybersecurity Supply Chain Requirements

[3] The Mad Dash to Find a Cybersecurity Force – The New York Times (nytimes.com)