1.1

1 2020 Report

Issue an Updated National Cyber Strategy

'24

This is some text inside of a div block.

View Details

This is some text inside of a div block.

1.1 Heading

2020 Report

2021

2022

2023

2024

Nearing Implementation

This recommendation will require executive action. While the Biden-Harris administration has indicated that cybersecurity will be an early priority, a new National Cyber Strategy has yet to be released. At a May 14 hearing before the House Armed Services’ Subcommittee on Cyber, Innovative Technologies, and Information Systems, Deputy Assistant Secretary of Defense for Cyber Policy Mieke Eoyang indicated that the Biden administration is currently conducting the review that will culminate in the issuance of a new National Cyber Strategy. Separately, CSC staff have offered the administration text for an executive order, providing further specificity in fulfilling the recommendation.

Nearing Implementation

On December 20, 2021, CSC co-chairs Senator Angus King (I-ME) and Representative Mike Gallagher (R-WI) sent a letter to President Joe Biden, urging the issuance of a national cyber strategy in order to bolster national deterrence through clear international signaling. On two separate occasions in 2021, administration officials indicated that a national cyber strategy is underway. In May of this year, the national security advisor delegated to the ONCD to draft the forthcoming national cyber strategy. Once the strategy is issued, this recommendation will be considered implemented. In order to be fully successful once implemented, the strategy should designate lines of effort and clarify priorities, and in doing so, draw on concepts including layered cyber deterrence, international engagement, resilience, public-private collaboration, and defending forward.

Implemented

On March 2, 2023, the Biden administration issued the National Cybersecurity Strategy. The Office of the National Cyber Director led the drafting of the strategy with input from cybersecurity experts inside and outside of government. The strategy includes five pillars: defend critical infrastructure; disrupt and dismantle threat actors; shape market forces to drive security and resilience; invest in a resilient future; and forge international partnerships to pursue shared goals. The administration then issued a “roadmap” for executing the strategy, detailing 65 initiatives led by 18 departments and agencies over the next three fiscal years. Acting National Cyber Director (NCD) Kemba Walden called the National Cybersecurity Strategy Implementation Plan a “living document,” anticipating adjustments to the plan “in response to changing cyber threat landscape.”

Implemented

On March 2, 2023, the Biden administration issued the National Cybersecurity Strategy, fully implementing this recommendation. In May 2024, the administration published the second version of its National Cybersecurity Strategy Implementation Plan and the 2024 cyber posture report. The second implementation plan noted that the administration had completed 33 initiatives aimed at implementing the strategy and introduced 31 new initiatives.

1.1.1

1 2020 Report

Develop a Multitiered Signaling Strategy

'21

'22

'23

'24

This is some text inside of a div block.

View Details

1.1.2

1 2020 Report

Promulgate a New Declaratory Policy

'21

'22

'23

'24

This is some text inside of a div block.

View Details

This is some text inside of a div block.

1.1.2 Heading

2020 Report

2021

2022

2023

2024

Limited Progress

This recommendation will require executive action. CSC staff have drafted text for an executive order that reforms the United States’ declaratory policy regarding cyberspace and is focused on a use-of-force threshold in order to reinforce deterrence of strategic cyberattacks.

On Track

The first step towards implementation of this recommendation will be the publication of a national cyber strategy or similar public document that declares that the United States will impose cyber and/or non-cyber costs against adversary campaigns, including those that fall below the use-of-force threshold. Following the Russian invasion of Ukraine, the Biden administration has sought to deter Russian retaliation in cyberspace (for instance, through CISA’s ongoing “Shields Up” campaign). These efforts help reinforce U.S. red lines in cyberspace, strengthening deterrence. To maintain deterrence, the United States must reinforce this strategy with clear and consistent action. On December 20, 2021, Senator King and Representative Gallagher sent a letter to President Biden urging the issuance of a national cyber strategy, which would serve as the implementation of this recommendation.

Implemented

As noted in previous recommendations, the publication of the National Cybersecurity Strategy serves as a declaratory policy vital for deterrence against adversaries of the United States, and its allies and partners. The strategy notes that Washington “will use all instruments of national power” to respond to malicious cyber actors. The strategy publicly declares that, working with allies and partners, the United States will impose cyber and/or non-cyber costs on adversaries, including for cyber activity that falls “below the threshold of armed conflict.” In addition, last year, Congress authorized the president to use U.S. Cyber Command to respond if the government determines that “there is an active, systematic, and ongoing campaign of attacks in cyberspace by a foreign power against the Government or the critical infrastructure.” This declaratory policy supports the intent of this recommendation.

Implemented

The publication of the National Cybersecurity Strategy serves as a declaratory policy vital for deterrence against adversaries, fully implementing this recommendation. In 2024, the new U.S. International Cyberspace and Digital Policy Strategy further promotes secure digital ecosystems and responsible behavior in cyberspace.

1.2

1 2020 Report

Create House Permanent Select and Senate Select Committees on Cybersecurity

'21

'22

'23

'24

This is some text inside of a div block.

View Details

1.2.1

1 2020 Report

Re-establish the Office of Technology Assessment

'21

'22

'23

'24

This is some text inside of a div block.

View Details

This is some text inside of a div block.

1.2.1 Heading

2020 Report

2021

2022

2023

'21

'22

'23

'24

This is some text inside of a div block.

View Details

This is some text inside of a div block.

1.3 Heading

2020 Report

2021

2022

2023

'21

'22

'23

'24

This is some text inside of a div block.

View Details

This is some text inside of a div block.

1.4 Heading

2020 Report

2021

2022

2023

'21

'22

'23

'24

This is some text inside of a div block.

View Details

This is some text inside of a div block.

1.4.1 Heading

2020 Report

2021

2022

2023

2024

Limited Progress

CSC staff have proposed legislation in support of this recommendation. Since the CTIIC was established in 2015, it has consistently been underresourced, lacking the funds, manpower, and analytical assets it needs to carry out its mission. Legislative action and subsequent appropriations are needed to implement this recommendation.

Nearing Implementation

Prior to the end of the CSC’s congressional mandate, Commission staff drafted proposed legislation requiring a report on the potential for improved federal all-source intelligence integration related to cyber incidents and threats. The Intelligence Authorization Act, passed as part of the FY22 spending omnibus, includes a provision that calls for a “report on the potential to strengthen all-source intelligence integration relating to foreign cyber threats.” This partially meets the intent of this recommendation. More critically, the Biden administration re-established the Cyber Threat Intelligence Integration Center, although it does not yet appear to be at the size recommended by the Commission. Full implementation will require action in response to the mandated report.

Nearing Implementation

As noted in last year’s assessment, the Biden administration re-established the Cyber Threat Intelligence Integration Center (CTIIC) at the Office of the Director of National Intelligence. The National Cybersecurity Strategy calls upon sector risk management agencies to work with CTIIC, CISA, and law enforcement agencies to “identify intelligence needs and priorities within their sectors.” The Intelligence Authorization Act, passed as part of the FY22 spending omnibus, calls for a “report on the potential to strengthen all-source intelligence integration relating to foreign cyber threats.” Full implementation of this recommendation will require action in response to the mandated report.

Implemented

The Biden administration re-established the Cyber Threat Intelligence Integration Center (CTIIC) at the Office of the Director of National Intelligence in FY22. With increased budget and manpower, CTIIC will play a critical role in integrating and disseminating cyber threat intelligence across federal agencies and supporting the director of national intelligence as the federal lead for intelligence support, as named in NSM-22. CTIIC will also play a lead role as a federal integrator in cyber open-source intelligence collaboration.

1.4.2

1 2020 Report

Strengthen the FBI’s Cyber Mission and the National Cyber Investigative Joint Task Force

'21

'22

'23

'24

This is some text inside of a div block.

View Details

This is some text inside of a div block.

1.4.2 Heading

2020 Report

2021

2022

2023

2024

On Track

The implementation of this recommendation requires additional funding. During the FY21 appropriations cycle, the CSC’s congressional Commissioners submitted a letter to the appropriations committees recommending an increase in funding to the Federal Bureau of Investigation Cyber Division of $28.5 million above the FY20 enacted level, and $17 million above the presidential FY21 request. The FY21 appropriations bill did not follow this recommendation. The CSC’s congressional Commissioners have again recommended funding support for these critical functions in the FY22 appropriations cycle, and the President’s Budget Request includes $40 million to “increase the FBI’s capacity for unilateral, joint, and enabled [cyber] operations with other Federal, State, local and international partners.”

Nearing Implementation

The FBI draws on a network of field offices and cyber task forces to both protect national security and enforce federal laws. Additionally, the National Cyber Investigative Joint Task Force (NCIJTF) works across the federal government to coordinate and integrate information from different departments and agencies to support cyber threat investigations. These elements are critical to protecting domestic cybersecurity but require additional resources to be maximally effective. In letters to appropriators in both FY21 and FY22, the CSC’s congressional commissioners recommended an increase in funding for the FBI’s cyber mission (as distinct from its own organizational cybersecurity efforts) and the NCIJTF. The Senate majority’s proposed funding bill for FY22 highlighted the importance of these efforts but directed the Department of Justice “to maintain its cybersecurity posture at no less than the fiscal year 2021 enacted level to defend against and respond to current and emerging threats,” with no increase in funding specified. The House version of the bill, however, included an increase of $40,000,000 for “the FBI’s efforts to deter, investigate, and pursue cyberthreats and cybercrime,” which aligned with an increase in the president’s budget request. Congress, however, ultimately did not include this funding in the final FY22 appropriations bill. The president’s budget request for FY23, however, includes a $52 million increase for the FBI’s cyber mission that, if met, would be a major step towards implementation of this recommendation. The recommendation would be fully implemented once the FBI uses the funds to bolster the NCIJTF and expand capability and personnel for investigative, analytical, and technical work.

Implemented

The FY24 president’s budget includes an additional $63 million to “build cyber investigative capabilities at FBI field divisions nationwide.” Additionally, the FBI requested four full-time positions and $27.2 million to enhance its cybersecurity posture and internal networks.

Implemented

In 2023, the FBI took over 1,000 actions against cyber adversaries, issued thousands of “individualized threat warnings,” and disseminated 78 public threat advisories. This year, the president’s budget includes a total of $11.3 billion for the FBI, with $7 million dedicated to enhancing cyber investigative capabilities. Additionally, the FBI expanded its network of Cyber Assistant Legal Attachés from 16 to 22 to further enhance global cyber threat intelligence and response capabilities.

1.5

1 2020 Report

Diversify and Strengthen the Federal Cyberspace Workforce

'21

'22

'23

'24

This is some text inside of a div block.

View Details

This is some text inside of a div block.

1.5 Heading

2020 Report

2021

2022

2023

2024

On Track

Legislation passed in the FY21 NDAA partially met this recommendation but requires an increase in appropriations to enable the newly authorized work (Sections 9401–9407), and the Federal Cybersecurity Workforce Expansion Act, introduced in June 2021, would implement elements of the recommendation related to federal apprenticeship and veteran upskilling programs if passed. Further authorization is needed to implement other elements of the recommendation. The CSC’s congressional Commissioners submitted a letter to the appropriations committees recommending an increase in funding during the FY21 appropriations cycle of $20 million above the FY20 enacted level in order to grow the CyberCorps

Nearing Implementation

As noted in last year’s assessment, the FY21 NDAA partially implemented this recommendation. Since that time, Congress considered numerous further elements of this recommendation in legislation and appropriations, with some provisions making it and some failing. The passage of the CHIPS and Science Act calls for strengthening the federal cyber Scholarship for Service program at the National Science Foundation and amends the Cybersecurity Enhancement Act of 2014 to add cybersecurity-related fields, such as artificial intelligence, quantum computing, and aerospace to the Scholarship for Service program. Senators Maggie Hassan (D-NH) and John Cornyn (R-TX) introduced the Federal Cybersecurity Workforce Expansion Act, which would have created a cybersecurity-focused upskilling pilot program for service members transitioning to civilian life and would have authorized a cybersecurity apprenticeship program at CISA, expressly permitting the use of an apprenticeship intermediary to support the process. Congress did not include these provisions in the FY22 NDAA but did include a provision (Section 1506) calling for the secretary of defense to assess current and future educational requirements for both military and civilian personnel. Separately, in June, President Biden signed the Federal Rotational Cyber Workforce Program Act into law. The intent of this rotational program is to attract, retain, and provide additional professional experiences to the federal cyber workforce. Beyond authorizing legislation, funding considerations are a recurring challenge in cybersecurity workforce development, where the scalability of efforts is critically important. In particular, the CSC has recommended additional investments in the CyberCorps: Scholarship for Service program, and CSC’s congressional commissioners recommended a $20 million increase in FY21 appropriations and again in FY22. The program has received increased funding, but not to the degree recommended. The president’s budget request for FY23 would implement a more significant increase, to $75 million, which comes far closer to the Commission’s recommendation. Similarly, the Regional Alliances and Multistakeholder Partnerships program established in FY21 NDAA Section 9401 requires additional funding to be fully effective. The president’s budget request for FY22 made no specific funding request for this cybersecurity workforce program and requested only minimal funding increases to the budget for the cybersecurity and privacy teams within the National Institute of Standards and Technology (NIST) supporting the effort. The FY22 omnibus spending bill designated only $500,000 for this effort. The president’s budget request for FY23 recommends $7 million, which is less than the Congressional Budget Office had indicated would be needed but still a valuable start for the program. Finally, the ONCD is assuming a leadership role on federal cyber workforce issues, convening a White House summit in mid-July. At the summit, Director Inglis announced that his office is leading the creation of a cyber education and workforce strategy. The Departments of Commerce and Labor also announced a cyber apprenticeship sprint to expand the existing apprenticeship programs. Earlier this year, CSC 2.0 published a memo outlining recommendations for the ONCD and Congress. While not included as a separate section of this assessment, positive movement towards implementing these recommendations is included in the assessment of the Commission’s original federal cyber workforce recommendation. Considering the summation of these actions, this recommendation is considered partially implemented, but cybersecurity workforce development must be a long-term effort that continues far past the specific recommendations made here.

Implemented

Cybersecurity programs face recurring budgetary constraints, but there were various opportunities for increased funding in FY23. The passage of the CHIPS and Science Act last year provided increased resources for the federal cyber workforce programs. In March, the Office of Personnel Management published implementation guidance on the Federal Rotational Cyber Workforce Program, which allows federal employees to gain exposure to different cybersecurity and IT-related job functions through rotations to other federal agencies. Meanwhile, on Capitol Hill, the Senate Homeland Security and Governmental Affairs Committee passed the Federal Cybersecurity Workforce Expansion Act out of committee in July. If signed into law, the legislation would create a cybersecurity-focused upskilling pilot program at the Department of Veterans Affairs for service members transitioning to civilian life and a cybersecurity apprenticeship program within CISA. Most significantly, the Office of the National Cyber Director published the National Cyber Workforce and Education Strategy with four core tenets focused on awareness, education, and the national and federal workforces. In light of these actions, this recommendation is considered fully implemented, but cybersecurity workforce development must be a long-term effort that continues far past the specific recommendations made here.

Implemented

Following the release last year of the National Cyber Workforce and Education Strategy, the administration continues to focus on better recruiting and retaining a diverse federal cyber workforce this year. In February 2024, the Office of Personnel Management released a workforce playbook consolidating existing government programs on federal employment, including cybersecurity, to help federal employers utilize the existing resources for fostering an inclusive workforce. Furthermore, many federal entities awarded grants for this effort, including $3.6 million for talent development partnerships at the National Institute of Standards and Technology, $39 million for state, local, tribal, and territorial governments to increase access to cyber education for “women, people of color, individuals with disabilities and underserved communities” through the Department of Labor, and $3 million for training underserved communities through CISA appropriations.

1.5.1

1 2020 Report

Improve Cyber-Oriented Education

'21

'22

'23

'24

This is some text inside of a div block.

View Details

This is some text inside of a div block.

1.5.1 Heading

2020 Report

2021

2022

2023

'21

'22

'23

'24

This is some text inside of a div block.

View Details

This is some text inside of a div block.

2.1 Heading

2020 Report

2021

2022

2023

'21

'22

'23

'24

This is some text inside of a div block.

View Details

This is some text inside of a div block.

2.1.1 Heading

2020 Report

2021

2022

2023

2024

On Track

This recommendation will require executive action, and CSC staff have provided text to the administration for a draft executive order that outlines actions federal departments and agencies can take to accomplish this recommendation through diplomatic engagement, expanded capacity building, and reinvigorated confidence-building measures. Recent executive actions demonstrate that steps implementing this recommendation are at least partially underway. The establishment of a working group announced in March involving the United States, Japan, India, and Australia is a major step toward international engagement to strengthen norms of responsible state behavior, and certainly shows that these issues have been elevated to the level of head-of-state conversations. However, many more steps such as these will need to be taken if this recommendation is to be fully implemented.

Nearing Implementation

Rather than any single action, implementation of this recommendation will take a broad shift in approach towards international cyberspace policy, and recent actions are indicative of progress. For example, the 30-nation summit to address ransomware in October of 2021 demonstrates a proactive approach toward working with the international community to reinforce existing norms around combating cybercrime. Similarly, the joint attribution in May 2022 of Russian government actions to disable Ukrainian satellite internet helps to reinforce norms around critical infrastructure. In NATO’s recently released 2022 Strategic Concept, the alliance reaffirmed its stance that a cyberattack against one of its member states could potentially trigger Article 5 of the North Atlantic Treaty, meaning that a cyberattack against one of its member states could be considered an attack against the alliance as a whole. The 2022 National Cyber Strategy should reflect this emphasis, clearly prioritizing enforcement of responsible state behavior in cyberspace through a collective approach with the international community. Implementing this recommendation will be more successful if the new Bureau of Cyberspace and Digital Policy is adequately resourced through FY23 appropriations.

Implemented

Pillar five of the National Cybersecurity Strategy commits the administration “to engage with countries working in opposition to our larger agenda on common problems” even while building a “broad coalition of nations working to maintain an open, free, global, interoperable, reliable, and secure Internet.” As noted in recommendation 2.1, the Bureau of Cyberspace and Digital Policy will improve interagency coordination to build consensus with allies and partners on cyber norms.

Implemented

A January 2024 GAO report noted that the elevation of the State Department’s Bureau of Cyberspace and Digital Policy to a bureau-level entity has “strengthened cyber issues within the State Department.” The bureau has also been instrumental in fostering international cooperation on cybersecurity. In June 2024, for example, CDP hosted discussions with 22 countries and the European Union on growing cybersecurity challenges and “efforts to deter malicious cyber activity and coordinate international responses.” Led by Deputy Assistant Secretary Liesyl Franz, these discussions emphasized the importance of strengthening norms and responsibilities, specifically in upholding the UN Framework for Responsible State Behavior in Cyberspace. In the past year, the CDP has been active in several key international forums that have resulted in enhanced international cooperation and collaboration. For example, the U.S.-EU Summit in October 2023 led to the development of best practices for Internet of Things security, known as the CyberSafe Products Action Plan.

2.1.2

2 2020 Report

Engage Actively and Effectively in Forums Setting International ICT Standards

'21

'22

'23

'24

This is some text inside of a div block.

View Details

This is some text inside of a div block.

2.1.2 Heading

2020 Report

2021

2022

2023

2024

On Track

Executive action and appropriations are required for this recommendation. To address both the requirements of this recommendation and the related requirements in Recommendation 4.1.2 below, the CSC’s congressional Commissioners submitted a letter to the appropriations committees recommending an increase in funding of $30 million for FY21 to support NIST’s cybersecurity and privacy programs. The Consolidated Appropriations Act for FY21 did not include this increase, though the requirements for work on standards have grown rapidly. Accordingly, the CSC’s congressional Commissioners have recommended a significant increase to support NIST’s cybersecurity and privacy programs for FY22. The President’s FY22 Budget Request includes a modest increase (approximately $2.35 million) for the Standards Coordination and Special Programs portfolio, which includes NIST’s work on international standards development, as well as increases totaling $3.5 million that would benefit specific standards initiatives in the areas of advanced communications and would help strengthen diversity and equity in the standards workforce. Separately, the Senate-passed USICA includes several provisions that make progress on this issue. Section 2306 would require the Secretary of Commerce to work with the Secretary of Energy to build capacity and training programs for U.S. engagement in standards setting, partner with the private sector on developing standards for digital economy technologies, and prioritize efforts focused on developing standards for emerging technologies. Section 3210 requires the President to establish an interagency working group, led by the Secretary of State, whose goal is to increase U.S. engagement in international standards bodies focused on 5G. The working group would also be assigned responsibility for providing a strategy that addresses U.S. engagement at 5G standards bodies, diplomatic engagement with partners and allies, China’s presence and engagement at standards bodies, and engagement with private-sector stakeholders to develop 5G standards. Other provisions direct the Assistant Secretary of Commerce for Communications and Information to prepare a briefing on barriers to robust U.S. government participation in standards activities at the International Telecommunication Union and on opportunities for further participation, authorize a grant program to encourage private-sector participation at standards bodies, and direct the Secretary of State to establish a regular dialogue with partners and allies on international regulatory issues, including standards setting.

Nearing Implementation

The passage of the CHIPS and Science Act partially implements this recommendation. Section 10245 creates technical standards education and training resources, improves the ability to partner with the private sector on standards for emerging technologies, drives greater coordination across the federal government on participation in international technical standards bodies, and provides education and workforce development efforts to promote participation in international technical standards bodies. However, a critical factor in the long-term success of this recommendation stems from NIST’s capacity to promote the development of and coordination around international standards. In large part, this is a function of growth in the cybersecurity and privacy program area. Despite the clear need for growth in this area, the FY22 budget submission to Congress reflected only a six percent increase over FY21 enacted spending, from $77.5 million to $81.9 million, though the administration asked for a 45 percent increase to NIST’s budget overall. The FY22 request also included a $2.35 million increase for the Standards Coordination and Special Programs portfolio, which supports international standards development, but overall, these increases are dwarfed by spending on other NIST priorities. The FY22 omnibus appropriations bill provided a minimal — $1.5 million — increase above the request for cybersecurity and privacy, an amount that clearly falls short of the increasing priority of international technical standards. The president’s FY23 budget does request a 20 percent ($18 million) increase for this funding priority, but after so many years of underfunding NIST’s cybersecurity and privacy mission, this increase is insufficient. The CSC’s congressional commissioners emphasized this critical funding need in an April 2022 letter to appropriators.

Nearing Implementation

The passage of the CHIPS and Science Act last summer triggered a cascade of efforts to create technical standards education and training resources and to partner with the private sector on emerging technologies. A critical factor in the long-term success of this recommendation is the National Institute of Standards and Technology’s (NIST’s) capacity to promote the development of and coordination around international standards.

Implemented

In February 2024, the United States, along with nine international allies and partners, produced a joint statement endorsing shared principles for the research and development of 6G wireless communication systems. Similarly, in April 2024, the U.S.-EU Trade and Technology Council’s joint statement committed the parties to “creating rules of the road for emerging technologies” for artificial intelligence and 6G wireless communication by hosting dialogues and information exchange. The Department of Energy, meanwhile, secured commitments from G7 countries and global energy industrial control systems manufacturers to adhere to voluntary supply chain cybersecurity standards. Other agencies, such as the National Telecommunications and Information Administration, are promoting multi-stakeholder engagements at international forums.

2.1.3

2 2020 Report

Improve Cyber Capacity Building and Consolidate the Funding of Cyber Foreign Assistance

'21

'22

'23

'24

This is some text inside of a div block.

View Details

This is some text inside of a div block.

2.1.3 Heading

2020 Report

2021

2022

2023

2024

On Track

Legislation and appropriations are needed to achieve this outcome. CSC staff have provided a legislative proposal that would consolidate foreign assistance in support of efforts to build cyber capacity. In addition, the CSC’s congressional Commissioners submitted a letter to the appropriations committees for FY21 recommending $10 million in increased funding for cyber capacity building. The FY21 NDAA authorized a military cyber capacity building program under Department of Defense authorities specific to Vietnam, Thailand, and Indonesia (Section 1256); the Consolidated Appropriations Act for FY21 included $7 million for capacity building through the Office of the Coordinator for Cyber Issues, which was repeated in the FY22 President’s Budget Request. In order to maintain these existing programs while also addressing new and emerging priorities, the CSC’s congressional Commissioners recommended an increase in funds for multiple foreign assistance accounts to be appropriated for FY22 for cybersecurity capacity building at the State Department. USICA may also enable progress in this area, as a provision of the proposed legislation would authorize $100 million in funding annually for FY22–26 in support of the Digital Connectivity and Cybersecurity Partnership, which aims in part to build cybersecurity capacity in foreign countries.

On Track

Implementation of this recommendation will require legislation and appropriations. Currently, cybersecurity capacity building efforts are split across a number of different funds, each with its own priorities and restrictions. In 2021, CSC staff provided relevant committee staff with a legislative proposal that would consolidate international cybersecurity capacity building efforts under a single fund. In the interim, the CSC’s congressional commissioners have and will continue to recommend increases to international development funds that support international capacity building. Encouragingly, the FY22 House consolidated appropriations report included specific increases in the funds for Assistance for Europe, Eurasia, and Central Asia and International Narcotics Control and Law Enforcement. It also recommended that “the [State] Department expand efforts to hire experienced personnel to support cybersecurity capacity building,” which would greatly expand the Department’s impact on global cybersecurity. However, the final bill did not include these provisions. The president’s budget request for FY23 does appear to consolidate several related areas of capacity building in the Economic Support Fund under the new Bureau for Cyberspace and Digital Policy, but that consolidates programs already in one fund rather than consolidating efforts across funds. Additionally, the president’s budget request for FY23 also provides $682 million for Ukraine to counter Russian influence, including cybersecurity issues and disinformation, an increase of $219 million above the 2021 enacted level.

Nearing Implementation

The co-chairs continue to support increased and sustained appropriations to support cyber capacity building funds at the Department of State. Established in April 2022, the CDP is responsible for leading and coordinating the department’s digital diplomacy efforts. To increase the efficacy of cyber capacity building efforts and ensure resources are prioritized based on cyber-specific geopolitical considerations, funding for these efforts should be consolidated from regional programs to CDP (with some limited exceptions for law enforcement-related capacity building).

Implemented

The State Department’s Bureau of Cyberspace and Digital Policy has actively promoted cyber capacity-building measures and fostered regional cooperation with specific programs like the Digital Connectivity and Cybersecurity Partnership. Strengthening “partner digital and cyber capacity” was one of four areas of action within the international cyber strategy. Importantly, the FY24 NDAA created a cyber assistance fund — the State Department’s Digital Connectivity and Related Technologies Fund — to help partners and allies improve resilience and respond to cyber incidents. Congress appropriated the first $50 million for the fund in the FY24 omnibus spending bill, and House appropriators included another $50 million in the FY25 State and Foreign Operations Appropriations bill. While this dedicated State Department funding is important, the executive branch will need to better integrate interagency partner capacity building efforts.

2.1.4

2 2020 Report

Improve International Tools for Law Enforcement Activities in Cyberspace

'21

'22

'23

'24

This is some text inside of a div block.

View Details

This is some text inside of a div block.

2.1.4 Heading

2020 Report

2021

2022

2023

'21

'22

'23

'24

This is some text inside of a div block.

View Details

This is some text inside of a div block.

2.1.5 Heading

2020 Report

2021

2022

2023

'21

'22

'23

'24

This is some text inside of a div block.

View Details

This is some text inside of a div block.

2.1.6 Heading

2020 Report

2021

2022

2023

'21

'22

'23

'24

This is some text inside of a div block.

View Details

3.1

3 2020 Report

Codify Sector-Specific Agencies as “Sector Risk Management Agencies” and Strengthen Their Ability to Manage Critical Infrastructure Risk

'21

'22

'23

'24

This is some text inside of a div block.

View Details

This is some text inside of a div block.

3.1 Heading

2020 Report

2021

2022

2023

'21

'22

'23

'24

This is some text inside of a div block.

View Details

This is some text inside of a div block.

3.1.1 Heading

2020 Report

2021

2022

2023

2024

Nearing Implementation

Implementation of this recommendation will require legislative action to direct the executive branch to conduct an initial risk identification and assessment of critical infrastructure based on currently defined national critical functions and to establish processes and procedures to establish a recurring National Risk Management Cycle. Legislation that would meet the intent of this recommendation is already underway. In April 2021, Senators Maggie Hassan and Ben Sasse introduced the National Risk Management Act of 2021, which would implement this recommendation. The bill has been folded into USICA; it would require the Secretary of Homeland Security, acting through the Director of CISA, to establish a recurring process for identifying, assessing, and prioritizing both risks to critical infrastructure (including both cyber and physical threats) and the resources needed to address such risks. Once an initial report identifying such risks has been produced, the President must deliver a national critical infrastructure resilience strategy, and the Secretary of Homeland Security must annually brief Congress on activities taken pursuant to the strategy.

On Track

While the Senate’s United States Innovation and Competition Act of 2021 had included the National Risk Management Act of 2021, introduced by Senator Hassan along with CSC Commissioner Senator Ben Sasse (R-NE), the final version of the CHIPS and Science Act did not. The provision, however, is being introduced in the Senate for the FY23 NDAA. If it passes, it would direct the secretary of homeland security, acting through the CISA director, to “establish a recurring process by which to identify, assess, and prioritize risks to critical infrastructure, considering both cyber and physical threats, the associated likelihoods, vulnerabilities, and consequences, and the resources necessary to address them.” This process is to be followed within a year by a national critical infrastructure resilience strategy “designed to address the risks identified by the Secretary” during the course of the national risk management cycle. This recommendation is not yet implemented and is awaiting legislative action.

On Track

This year, Senators Maggie Hassan (D-NH) and Mitt Romney (R-UT) re-introduced the National Risk Management Act of 2021 after the bill was omitted from the CHIPS and Science Act. On March 29, 2023, the Senate Homeland Security and Governmental Affairs Committee voted to advance the bill to the Senate floor. If passed, the bill would establish a process for CISA to study “cyber and physical threats to critical infrastructure” and require a report to Congress with recommendations to mitigate cyber risks. The Department of Homeland Security would also lead risk identification and assessment in coordination with SRMAs, critical infrastructure owners and operators, the Office of the National Cyber Director, and other relevant parties to support the President’s National Critical Infrastructure Resilience Strategy.

Implemented

NSM-22 fully implemented this recommendation by directing the Department of Homeland Security, through CISA, to create a coordinated national risk management cycle to “identify, assess, and prioritize [cyber and physical] risk” facing critical infrastructure. This includes developing sector-specific risk assessments and risk management plans that will be integrated into a biennial National Infrastructure Risk Management Plan.

3.1.2

3 2020 Report

Establish a National Cybersecurity Assistance Fund

'21

'22

'23

'24

This is some text inside of a div block.

View Details

3.2

3 2020 Report

Develop and Maintain Continuity of the Economy Planning

'21

'22

'23

'24

This is some text inside of a div block.

View Details

This is some text inside of a div block.

3.2 Heading

2020 Report

2021

2022

2023

'21

'22

'23

'24

This is some text inside of a div block.

View Details

This is some text inside of a div block.

3.3 Heading

2020 Report

2021

2022

2023

2021

2022

2023

2024

On Track

This recommendation requires executive action, and CSC staff have proposed text for the needed executive order. Full implementation would include revising the National Cyber Incident Response Plan to add scenario-specific and sector-specific annexes drafted in consultation with sector-specific agencies and the Sector Coordinating Councils, accounting for options to mobilize additional resources to augment the government’s response efforts, and integrating planning efforts with existing emergency response and disaster recovery programs operated by federal and SLTT entities. Section Six of the Biden administration’s executive order on improving the nation’s cybersecurity requires the development of a playbook that would drive planning to improve and standardize processes for federal cyber incident response. This order does not precisely implement the CSC’s recommendation, because the Commission focused on planning that involved a broader group of stakeholders rather than just the federal government. However, it has a similar intent as the Commission’s recommendation and helps lay the groundwork for future progress.

On Track

While this recommendation has not been implemented as the Commission originally conceived, several activities are currently underway that align with the overall intent of the recommendation. In 2021, the Executive Order on Improving the Nation’s Cybersecurity requires the development of incident response playbooks. The FY22 NDAA requires updates and stakeholder outreach around the National Cyber Incident Response Plan. Meanwhile, CISA established the Joint Cyber Defense Collaborative (JCDC) in August 2021, which continues to expand its connections with the private sector to improve planning. For example, CISA officials successfully handled the widespread exploitation of the Log4shell software vulnerability (Log4j) through the JCDC. JCDC members quickly convened to share information about the Log4j vulnerability, operationalizing public-private sector partnerships. Through the JCDC, CISA informed federal agencies to patch devices containing the Log4shell vulnerability, created a crowdsourced GitHub repository displaying vulnerable products and available patches, and provided resources to small- and medium-sized enterprises.

Nearing Implementation

In January, CISA’s Joint Cyber Defense Collaborative (JCDC) released its 2023 Planning Agenda, which notes that JCDC will lead the drafting of the National Cyber Incident Response Plan (NCIRP). This announcement shows progress toward implementing the commission’s original recommendation. The NCIRP must incorporate two elements: 1) outlining how federal, state, local, tribal, and territorial governments and private entities respond to significant cyber incidents affecting critical infrastructure, and 2) identifying options and resources to supplement the government’s response. Integrating the two into existing emergency response and disaster recovery mechanisms is crucial.

Nearing Implementation

View Details

This is some text inside of a div block.

3.3.6 Heading

2020 Report

2021

2022

2023

2024

Implemented

Section 1729 of the FY21 NDAA accomplished this recommendation, which appropriations will be needed to execute. The legislation directs the Secretary of Defense to evaluate the statutes, rules, regulations, and standards that pertain to the use of the National Guard for the response to and recovery from significant cyber incidents, and to issue updates to existing plans and policies as needed. At a hearing held by the House Armed Services Subcommittee on Cyber, Innovative Technologies, and Information Systems, Deputy Assistant Secretary of Defense for Cyber Policy Mieke Eoyang indicated that the Biden administration is undertaking the review required by the FY21 NDAA and expects to complete it during the summer. administration is undertaking the review required by the FY21 NDAA and expects to complete it during the summer.

Nearing Implementation

This recommendation was implemented by FY21 NDAA Section 1729, which requires the secretary of defense to evaluate the rules and standards pertaining to the use of the National Guard in response to a cyber incident. The report on this evaluation has not yet been submitted to Congress. Once this report is reviewed, further action may still be needed to improve the National Guard’s ability to respond in the event of a major cyber incident.

On Track

Section 1729 of the FY21 NDAA addressed this recommendation, but the National Guard report evaluating rules and standards pertaining to the guard’s use in response to a cyber incident was incomplete. Despite this, there has been meaningful improvement in the guard’s capabilities to protect critical infrastructure. In 2022, 5,000 guard personnel provided cybersecurity support ahead of the midterm elections. Clear guidance on the utilization of National Guard capabilities will be needed to fully address this recommendation.

On Track

According to National Guard officials, the Guard has more than 2,000 soldiers trained in cybersecurity. The National Guard’s unique position bridging military and civilian sectors and federal and state government authorities makes it ideally suited to respond to domestic cyber threats. Additionally, the Guard also plays a role in international cyber capacity building. From June 24 to July 5, 2024, approximately 50 guardsmen and airmen participated in the Adriatic Regional Security Cyber Cooperation in Slovenia alongside servicemembers from seven other countries. Earlier in the year, nearly 1,000 participants, many of whom are members of the National Guard State Partnership Program, gathered in Virginia for Cyber Shield 2024, a two-week cybersecurity training hosted by the National Guard. This event is the “longest-running and largest Department of Defense cyber defense exercise,” according to the department.

3.4

3 2020 Report

Improve the Structure and Enhance Funding of the Election Assistance Commission

'21

'22

'23

'24

This is some text inside of a div block.

View Details

This is some text inside of a div block.

3.4 Heading

2020 Report

2021

2022

2023

'21

'22

'23

'24

This is some text inside of a div block.

View Details

3.5

3 2020 Report

Build Societal Resilience to Foreign Malign Cyber-Enabled Information Operations

'21

'22

'23

'24

This is some text inside of a div block.

View Details

This is some text inside of a div block.

3.5 Heading

2020 Report

2021

2022

2023

2024

Limited Progress

Legislation and appropriations are needed to accomplish this recommendation. To that end, CSC staff have put forward two legislative proposals. The first establishes a grant program for the development of education programs enabling Americans to identify foreign malign cyber-enabled information operations. The second commissions a GAO study on the effectiveness of existing cybersecurity education programs and establishes a grant program for research on the effectiveness of cybersecurity literacy curricula. In addition to a request in support of cybersecurity awareness at CISA, the CSC’s congressional Commissioners submitted a letter to the appropriations committees recommending an increase in funding of $15 million for FY21 in support of relevant Department of Education programs, of which only $250,000 was appropriated, and made further recommendations in FY22 appropriations. The CSC’s congressional Commissioners also recommended an increase in funding in support of a Department of Defense (DoD) pilot program on civics education created in Section 234 of the FY20 NDAA. The Consolidated Appropriations Act for FY21 included a more modest increase of $2 million for civics education. Accordingly, the CSC’s congressional Commissioners recommended an additional increase in FY22, as well as additional funding in other departments to promote digital civics education, media literacy, and academic improvements in civics and history.

Limited Progress

Prior to this year, CSC staff drafted legislation to establish an educational grant program and request a GAO report. In late 2021, the Commission added to these two lines of effort through its white paper on countering disinformation, which proposed a Civic Education Task Force and several other measures to promote education as a tool for building resilience to disinformation. The CSC’s congressional commissioners wrote a letter to the appropriations committees recommending additional funding for the Institute for Education Sciences and the National Defense Education Program, which was not included in the FY22 spending bill. The CSC’s congressional commissioners are pursuing this issue again in FY23 appropriations.

On Track

The Biden administration released the National Cybersecurity Workforce and Education Strategy outlining a comprehensive strategy for improving cyber education and workforce needs in the United States. The first pillar of the strategy is “equip[ping] every American with foundational cyber skills” with three core components: digital literacy, computational literacy, and digital resilience. Last year, the Department of Defense also requested $132 million for the National Defense Education Program, which includes a pilot program for civics education. The commission had recommended increased funding for this program. The FY22 spending bill did not provide funds for this program, but the FY23 NDAA authorized $140 million.

On Track

Progress has remained steady with state-level digital literacy efforts spurred by the American Rescue Plan Act of 2021 and the bipartisan Infrastructure Investment and Jobs Act of 2021. For instance, in February 2024, Kansas announced a $2.8 million award to 15 organizations to provide digital literacy training programs. And in April 2024, California received a $70 million award to implement measures in the “California Digital Plan” to provide affordable internet and digital literacy education to its state residents. Despite these efforts, further executive action and appropriations are required to build societal resilience.

3.5.1

3 2020 Report

Reform Online Political Advertising to Defend against Foreign Influence in Elections

'21

'22

'23

'24

This is some text inside of a div block.

View Details

4.1

4 2020 Report

Establish and Fund a National Cybersecurity Certification and Labeling Authority

'21

'22

'23

'24

This is some text inside of a div block.

View Details

This is some text inside of a div block.

4.1 Heading

2020 Report

2021

2022

2023

2024

On Track

Authorizing legislation and appropriations are needed to accomplish this recommendation. However, progress can also be made through executive action, and the Biden administration’s executive order on improving the nation’s cybersecurity did help lay groundwork for future progress. CSC staff also put forward a legislative proposal in support of this recommendation. If authorized, the National Cybersecurity Certification and Labeling Authority (NCCLA) will require the appropriation of funds. Absent such an authorization, the U.S. government can still make some, albeit limited, progress toward implementing this recommendation by appropriating funding for the Federal Communications Commission’s Office of Engineering and Technology, Laboratory Division, to begin work to assess existing cybersecurity certifications pertinent to critical infrastructure and develop further resources as needed.

On Track

In 2021, Senators King and Sasse introduced the Defense of United States Infrastructure Act of 2021, which included provisions that would establish a National Cybersecurity Certification and Labeling Authority (NCCLA). Commission staff also drafted a variant of this legislation calling for a report to Congress on what such an authority might look like in implementation. While many provisions from the Defense of United States Infrastructure Act were considered for inclusion in an amendment to the Senate version of the FY22 NDAA, this provision ultimately was not. The CSC’s congressional commissioners are working this year to reengage on this legislation. Meanwhile, the 2021 Executive Order on Improving the Nation’s Cybersecurity began to lay the groundwork for future certification and labeling efforts on which the administration can build on in the coming year. In particular, NIST issued criteria for Internet of Things (IoT) device and software security, indicating the desired outcomes of secure products. However, further executive action (which may be expedited with a congressional mandate) will be needed to map these criteria to more concrete standards that can serve as the basis for a labeling system.

Nearing Implementation

In July, the White House announced a new initiative, dubbed the U.S. Cyber Trust Mark, led by the Federal Communications Commission, to create a voluntary cybersecurity labeling program for Internet of Things consumer devices. Once implemented, this labeling effort would inform consumers about the cybersecurity risks of IoT products, identifying products that voluntarily employ better cybersecurity practices.

Implemented

The Federal Communications Commission in March approved the U.S. Cyber Trust Mark, a voluntary cybersecurity labeling program for consumer Internet of Things devices, fully implementing this recommendation. This initiative certifies devices that meet cybersecurity criteria outlined by the National Institute of Standards and Technology, helping consumers make informed decisions and encouraging manufacturers to adopt secure practices. Major retailers and technology companies, including Amazon, BestBuy, and Google, have signed up to participate.

4.1.1

4 2020 Report

Create or Designate Critical Technology Security Centers

'21

'22

'23

'24

This is some text inside of a div block.

View Details

4.1.2

4 2020 Report

Expand and Support the National Institute of Standards and Technology Security Work

'21

'22

'23

'24

This is some text inside of a div block.

View Details

This is some text inside of a div block.

4.1.2 Heading

2020 Report

2021

2022

2023

2024

Limited Progress

To address both the requirements of this recommendation and the related requirements in Recommendation 2.1.4 (see above), the CSC’s congressional Commissioners submitted a letter to the appropriations committees recommending an increase in funding of $30 million for FY21 to support NIST’s cybersecurity and privacy programs. The Consolidated Appropriations Act for FY21 did not include this increase, though the requirements for work on standards have grown rapidly. In particular, the recent executive order on improving the nation’s cybersecurity requires the Director of NIST to establish best practices, guidelines, guidance, definitions, reviews, consultations, and other core elements needed to improve and standardize federal cybersecurity, a tasking that makes this request even more urgent. Despite this expansion of its cybersecurity mission, the President’s Budget Request recommended only a modest 6 percent increase to the Cybersecurity and Privacy budget function at NIST, while the agency-wide NIST budget grew almost 45 percent. Recognizing NIST’s critical role as an enabler of a stronger national cyber ecosystem nationwide, the CSC’s congressional Commissioners recommended a much more significant increase to support NIST’s cybersecurity and privacy programs for FY22.

Implemented

Implementation of this recommendation is principally contingent on an increase in funding to the National Institute of Standards and Technology in support of the cybersecurity and privacy budget. While the president’s budget request for FY22 increased funding to NIST organization-wide by nearly 45 percent relative to the FY21 budget, the cybersecurity and privacy budget increased by only six percent. This growth is out of step with the expansion of responsibilities assigned to NIST in the Executive Order on Improving the Nation’s Cybersecurity, as well as an expanded workforce development role mandated in FY21 NDAA Section 9401. The Consolidated Appropriations Act, 2022 increased appropriations for cybersecurity and privacy at NIST by $1.5 million, which falls drastically short of the $54 million increase over the FY22 request that the CSC’s congressional commissioners recommended in a letter to congressional appropriators for FY23. The passage of the CHIPS and Science Act provides clarity on NIST’s authority for cybersecurity and privacy activities. Section 10223 of the act allows NIST to provide consensus-based technical standards and guidance on technologies that enhance software and cloud security and privacy.

Implemented

As noted earlier in Recommendation 2.1.2, the FY23 omnibus spending bill appropriated $1.65 billion to the National Institute on Standards and Technology. This includes a $2 million increase above the FY22 enacted level for addressing cybersecurity issues of “industrial control systems devices procured by the Federal government.” In total, NIST’s cybersecurity and privacy mission saw an increase of $20 million after years of underfunding.

Nearing Implementation

View Details

This is some text inside of a div block.

4.3 Heading

2020 Report

2021

2022

2023

2024

On Track

Authorizing legislation is needed to establish the bureau. The Commission staff proposed draft legislation during the 2020 legislative cycle, working with stakeholders and industry groups to clarify the relationship between the proposed bureau and the private sector. Following that process, CSC staff have proposed a revised draft for consideration during the 2021 legislative cycle. If authorized, the Bureau of Cyber Statistics will still require the appropriation of funds. proposed a revised draft for consideration during the 2021 legislative cycle. If authorized, the Bureau of Cyber Statistics will still require the appropriation of funds.

Limited Progress

Implementation of this recommendation requires authorizing language, and Commission staff and the CSC’s congressional commissioners worked in support of this recommendation through the 2021 legislative cycle. The provision was introduced as a part of the Defense of United States Infrastructure Act. Ultimately, however, the provision was not included in the FY22 NDAA, which could have served as a vehicle to expedite the passage of the legislation. Representative Jim Langevin (D-RI) continued the Commission’s efforts by introducing the recommendation as an amendment to the FY23 NDAA, but it was not included.

On Track

Last year, then Representative Jim Langevin (D-RI) introduced the recommendation as an amendment to the FY23 NDAA, but it was not included in the final bill. This year’s NDAA could prompt renewed movement. Section 1715 of the Senate version of the bill requires the Department of Defense to conduct an assessment on establishing and resourcing the Office of Cyber Statistics as part of the cyber incident reporting requirement. If the provision remains in the final bill, the resulting report could provide crucial information for fulfilling this recommendation.

On Track

View Details

This is some text inside of a div block.

4.5 Heading

2020 Report

2021

2022

2023

2024

On Track

This recommendation can be accomplished through a combination of legislative and executive action and requires appropriations. Though not precisely meeting the intent of this recommendation, the Biden administration’s executive order on improving the nation’s cybersecurity does move the conversation on cloud security within the federal government forward by mandating updates to agency plans to secure cloud services as well as updates to guidance for the Federal Risk and Authorization Management Program (FedRAMP). In addition, CSC staff have proposed legislation in support of this recommendation. While some elements of this recommendation require further authorization, support through appropriations can help advance the activities covered under existing authorities. Ideally, the cloud security certification would be established through NCCLA, which would coordinate with NIST to develop metrics and standards for a secure cloud benchmark and serve as the certifying agent responsible for conducting initial and subsequent audits of eligible applicants. But even without congressional authorization for NCCLA, work on the cloud security certification can still move forward through executive or legislative action directing DHS to spearhead the effort and serve as the certifying agent, in coordination with NIST. The draft legislation proposed by CSC staff on the topic includes language for both circumstances, ensuring that whether or not NCCLA exists, Congress has model text that can be used to establish a federal cloud security certification. The CSC’s congressional Commissioners submitted a letter to the appropriations committees recommending increased appropriations for joint efforts at CISA and NIST to enable the research needed to build a foundation for a cloud security certification and to allow CISA to serve as the certifying agent if NCCLA is not authorized.

On Track

As envisioned by the Commission, the National Cybersecurity Certification and Labeling Authority (Recommendation 4.1) would partner with NIST, the Office of Management and Budget, and DHS to develop a certification to attest to the security of cloud services. The recommendation also outlined a process for developing cloud security metrics and standards and called for an update to the Federal Risk and Authorization Management Program (FedRAMP). While the establishment of the NCCLA would greatly expedite the implementation of this recommendation as a whole, policymakers can still pursue major elements of the recommendation absent the creation of the NCCLA. Meanwhile, the House and Senate versions of the FY22 omnibus appropriation urged the executive to develop guidelines for secure cloud adoption, but it did not make the final version. The May 2021 Executive order on Improving the Nation’s Cybersecurity called for improved agency plans to secure cloud services and updates to FedRAMP. Notably, the successful execution of these changes will require funding for expanded lines of work, particularly at NIST. As is also the case for Recommendation 4.1.2 above, the history of limited growth in appropriations for NIST’s cybersecurity and privacy budget function is concerning. The CSC’s congressional commissioners have written letters to congressional appropriators urging increased resources for this important funding priority.

Nearing Implementation

In the FY23 NDAA, Congress authorized the Federal Risk and Authorization Management Program (FedRAMP) to standardize security assessment of cloud computing products and services used for unclassified federal information.

Nearing Implementation

The Commission urged the National Institute of Standards and Technology and the Department of Homeland Security to develop a standard for attesting to the security of cloud service providers and to update the relevant requirements in the Federal Risk and Authorization Management Program (FedRAMP) so that all cloud providers meet the security standards. FedRAMP’s March 2024 roadmap committed to simplifying the process for cloud-based computing infrastructure and applications to become certified to sell to the U.S. government. FedRAMP is also committed to working with CISA to better define security requirements for cloud providers. More executive and legislative action is necessary to expand efforts around securing those cloud services used by the federal government to cover all commercially available cloud service providers.

4.5.1

4 2020 Report

Incentivize the Uptake of Secure Cloud Services for Small and Medium-Sized Businesses and State, Local, Tribal, and Territorial Governments

'21

'22

'23

'24

This is some text inside of a div block.

View Details

4.5.2

4 2020 Report

Develop a Strategy to Secure Foundational Internet Protocols and Email

'21

'22

'23

'24

This is some text inside of a div block.

View Details

This is some text inside of a div block.

4.5.2 Heading

2020 Report

2021

2022

2023

'21

'22

'23

'24

This is some text inside of a div block.

View Details

This is some text inside of a div block.

4.5.3 Heading

2020 Report

2021

2022

2023

'21

'22

'23

'24

This is some text inside of a div block.

View Details

This is some text inside of a div block.

4.6 Heading

2020 Report

2021

2022

2023

'21

'22

'23

'24

This is some text inside of a div block.

View Details

This is some text inside of a div block.

4.6.1 Heading

2020 Report

2021

2022

2023

'21

'22

'23

'24

This is some text inside of a div block.

View Details

This is some text inside of a div block.

4.6.2 Heading

2020 Report

2021

2022

2023

2021

2022

2023

2024

Significant Barriers

The Commission expected and has encountered significant pressure against this recommendation, which is one of the four that face known significant barriers to implementation. However, the recommendation has been drafted in proposed legislation and stands ready should a future emergency create the political impetus needed to overcome existing barriers.

On Track

As was the case in the prior year, the Commission has encountered significant barriers to the implementation of this recommendation. However, as the costs to individuals of poor privacy protections continue to stack up, attitudes towards data security and privacy protection seem to be changing among lawmakers. The Commission has drafted and published legislation, making it available should there be an increased appetite to pursue the issue in the future. The passage of the CHIPS and Science Act shows progress in establishing a standardized requirement for the collection, retention, and sharing of user data. Section 10375 establishes a National Secure Data Service demonstration project to test models for government-wide data linkage and access infrastructure. Under the National Science Foundation, the project aims to improve coordination across national data collection, including privacy and confidentiality protections, emphasizing the need to handle raw data and sensitive inputs securely. Furthermore, there is proposed legislation on this issue. In June 2022, the House Energy and Commerce Committee introduced the American Data Privacy and Protection Act, which would create a federal consumer privacy law standardizing consumers’ expectations on managing personal data and regulations for companies on how they could use that data. The CSC 2.0 project will remain focused on this issue.

On Track

Various strategic objectives in the National Cybersecurity Strategy work to protect consumer privacy and sensitive information. Meanwhile, on Capitol Hill, after Congress failed to pass data privacy legislation last year, the House Energy and Commerce Committee resumed discussions in March on the need for a federal data privacy bill.

Limited Progress

In June 2024, the House of Representatives postponed the scheduled markup of the American Privacy Rights Act, the latest legislative proposal in Congress on data privacy. This third consecutive year of setbacks underscores the ongoing challenges in creating a unified federal data privacy framework.

4.7.1

4 2020 Report

Pass a National Breach Notification Law

'21

'22

'23

'24

This is some text inside of a div block.

View Details

5.1

5 2020 Report

Codify the Concept of “Systemically Important Critical Infrastructure”

'21

'22

'23

'24

This is some text inside of a div block.

View Details

This is some text inside of a div block.

5.1 Heading

2020 Report

2021

2022

2023

'21

'22

'23

'24

This is some text inside of a div block.

View Details

5.1.2

5 2020 Report

Strengthen and Codify Processes for Identifying Broader Private-Sector Cybersecurity Intelligence Needs and Priorities

'21

'22

'23

'24

This is some text inside of a div block.

View Details

This is some text inside of a div block.

5.1.2 Heading

2020 Report

2021

2022

2023

2024

On Track

Like Recommendation 5.1.1, this recommendation requires legislation or executive action. Legislative language proposed by the CSC staff directs the Director of National Intelligence to work with the CISA Director and SRMAs to establish a formal, recurring process for soliciting and compiling input from critical infrastructure sectors to inform national intelligence priorities. These inputs would help identify potential targets of nation-state cyber threats, gaps in critical infrastructure cybersecurity efforts, ways to refocus information collection and analysis in support of addressing those gaps, and means to assist SRMAs in identifying priorities and coordinating with the intelligence community. The draft legislation also requires the Director of National Intelligence and the CISA Director to submit an annual report to Congress assessing how such critical infrastructure inputs are shaping intelligence collection and evaluating efforts to share information with critical infrastructure owners and operators. In addition, CSC staff have drafted an executive order for the administration that directs the same set of actions.

Limited Progress

While the FY22 NDAA made strides in intelligence support and coordination with the private sector, those efforts focused on DoD and DHS via CISA, rather than the Office of the Director of National Intelligence. Making this recommendation further unique, it calls for a recurrent process by which critical infrastructure sectors’ input can inform national intelligence priorities. Critical infrastructure owners and operators can provide critical insight into known gaps in their own cybersecurity or nodes in their operations that may be particularly critical, which can help identify areas that may be targeted by future nation-state adversaries. The provision of this information can also serve as a feedback mechanism to help focus intelligence collection on areas where critical infrastructure owners and operators have identified vulnerabilities or are limited in their own information-gathering efforts. The Commission staff has drafted a legislative proposal for this recommendation, but the changes could also be carried out via executive branch action in the absence of specific authorizing legislation.

On Track

In August, the Office of the Director of National Intelligence published its 2023 National Intelligence Strategy, which notes that the intelligence community must “adopt new approaches” and “build new and restructure existing collaborative mechanisms with non-state actors” to protect U.S. critical infrastructure.

Nearing Implementation

NSM-22 directs the director of national intelligence, in coordination with the Department of Homeland Security and sector risk management agencies, to identify and address the intelligence needs of critical infrastructure owners and operators. To fully implement this recommendation, additional actions are required, including codifying legal protections to safeguard routinely shared information from public disclosure. The executive branch also needs to address the findings of an intelligence community audit released prior to NSM-22 detailing key limitations to sharing information with the private sector, including over-classification and inconsistent formats.

5.1.3

5 2020 Report

Empower Departments and Agencies to Serve Administrative Subpoenas in Support of Threat and Asset Response Activities

'21

'22

'23

'24

This is some text inside of a div block.

View Details

5.2

5 2020 Report

Establish and Fund a Joint Collaborative Environment for Sharing and Fusing Threat Information

'21

'22

'23

'24

This is some text inside of a div block.

View Details

This is some text inside of a div block.

5.2 Heading

2020 Report

2021

2022

2023

'21

'22

'23

'24

This is some text inside of a div block.

View Details

This is some text inside of a div block.

5.2.1 Heading

2020 Report

2021

2022

2023

'21

'22

'23

'24

This is some text inside of a div block.

View Details

This is some text inside of a div block.

5.2.2 Heading

2020 Report

2021

2022

2023

'21

'22

'23

'24

This is some text inside of a div block.

View Details

5.3

5 2020 Report

Strengthen an Integrated Cyber Center Within CISA and Promote the Integration of Federal Cyber Centers

'21

'22

'23

'24

This is some text inside of a div block.

View Details

This is some text inside of a div block.

5.3 Heading

2020 Report

2021

2022

2023

'21

'22

'23

'24

This is some text inside of a div block.

View Details

This is some text inside of a div block.

5.4 Heading

2020 Report

2021

2022

2023

2021

2022

2023

'21

'22

'23

'24

This is some text inside of a div block.

View Details

6.1.2

6 2020 Report

Expand Current Malware Inoculation Initiatives

'21

'22

'23

'24

This is some text inside of a div block.

View Details

This is some text inside of a div block.

6.1.2 Heading

2020 Report

2021

2022

2023

2021

2022

2023

2024

Nearing Implementation

This recommendation will require executive action. CSC staff have drafted text for an executive order that mandates a review of the impact of defend forward and of persistent engagement on partners and allies, as well as an assessment of opportunities for collaboration and coordination with partners and allies in this area. Discussions with allies and partners, particularly those in NATO, during President Biden’s June 2021 visit to Europe signal an intent to engage in these activities, an intent which is also reflected in the recent joint statement attributing malicious cyber activity and irresponsible state behavior to the government of China, but implementation will require turning those discussions into action.

Nearing Implementation

Implementation of this recommendation is based on executive action. In particular, the U.S. government could begin implementing this recommendation by reviewing the ways in which defend forward activities and persistent engagement may impact allies and partners and by assessing opportunities to expand collaboration. However, if these reviews are completed but not made publicly available, they would be difficult to use as a barometer of progress. With this in mind, externally visible actions show significant progress in this area. For example, the G7 leaders formally launched the Partnership for Global Infrastructure and Investment at the June 2022 summit, upholding their commitment “to the framework of responsible state behaviour in cyberspace.” In addition, NATO released its 2022 Strategic Concept during its June summit, reaffirming last year’s strategy that a cyberattack against one of its member states could potentially trigger Article 5 of the North Atlantic Treaty, meaning that a cyberattack against one of its member states could be considered an attack against the alliance as a whole. There has been ongoing cooperation with allies and partners for persistent engagement. In the four years prior to May 2022, U.S. Cyber Command conducted 28 hunt-forward operations, deploying the Cyber National Mission Force to 16 nations. General Nakasone stated these hunt forward operations were “directly in support of mission partners,” bolstering the resilience of NATO allies and partners.

Implemented

Since 2018, U.S. Cyber Command has conducted more than 40 missions in 21 countries. In May 2023, the Defense Department released an unclassified summary of its cyber strategy, which states that the U.S. Cyber Command will continue to assist allies and partners in defending their networks through hunt forward missions.

Implemented

In the 2024 posture statement, newly confirmed U.S. Cyber Command Commander General Timothy Haugh reported that in 2023, U.S. Cyber Command had active hunt forward operations simultaneously across all geographic commands “for the first time.” Last year, U.S. Cyber Command conducted 22 hunt forward operations, a steady increase over prior years.

6.1.6

6 2020 Report

Require the DoD to Define Reporting Metrics

'21

'22

'23

'24

This is some text inside of a div block.

View Details

This is some text inside of a div block.

6.1.6 Heading

2020 Report

2021

2022

2023

2021

2022

2023

'21

'22

'23

'24

This is some text inside of a div block.

View Details

This is some text inside of a div block.

6.2.1 Heading

2020 Report

2021

2022

2023

'21

'22

'23

'24

This is some text inside of a div block.

View Details

6.2.3

6 2020 Report

Designate a Threat-Hunting Capability Across the Department of Defense Information Network

'21

'22

'23

'24

View Details

This is some text inside of a div block.

NCD 1

Heading

White Paper

2021

2022

2023

Provide State, Local, Tribal, and Territorial Government and Small and Medium-sized Business IT Modernization Grants

'21

'22

'23

'24

This is some text inside of a div block.

View Details

PAN 1.2

Pandemic (PAN)

White Paper

Pass an Internet of Things Security Law

'21

'22

'23

'24

This is some text inside of a div block.

View Details

This is some text inside of a div block.

PAN 1.2

Heading

White Paper

2021

2022

2023

Support Nonprofits That Assist Law Enforcement’s Cybercrime and Victim Support Efforts

'21

'22

'23

'24

This is some text inside of a div block.

View Details

PAN 1.4

Pandemic (PAN)

White Paper

Increase Nongovernmental Capacity to Identify and Counter Foreign Disinformation and Influence Campaigns

'21

'22

'23

'24

This is some text inside of a div block.

View Details

This is some text inside of a div block.

PAN 1.4

Heading

White Paper

2021

2022

2023

2024

Limited Progress

CSC staff have proposed legislation that would authorize the Department of Justice, in consultation with the Department of Homeland Security, Department of State, and the National Science Foundation, to provide grants to nonprofit centers seeking to identify, expose, and explain malign foreign influence campaigns to the American public while putting those campaigns into context in order to avoid amplifying them. Appropriations will be needed to advance this recommendation, and the CSC’s congressional Commissioners included a request in support of this recommendation in a letter to congressional appropriations committees for FY22.

Limited Progress

This recommendation was originally proposed as a grant program administered by the Department of Justice in consultation with other departments and agencies to enable nonprofit organizations to identify malign foreign influence campaigns and explain them to the public. Implementing this original recommendation may require authorization of such a program and would necessitate further appropriations. However, the Commission expanded its work on this topic through the publication of a white paper on foreign disinformation in December 2021, which outlines several additional paths for addressing the issues identified in this recommendation.

On Track

Earlier this year, the Department of State’s Global Engagement Center released a $1 million notice of funding opportunity to research strategies to counter Russian disinformation and propaganda. In June, the National Science Foundation requested proposals for a workshop to discuss research security threats, including disinformation and foreign influence. For full implementation of the recommendation, Congress should authorize and appropriate funds for grant programs at the departments of Justice and Homeland Security and the National Science Foundation to support federal and international partners’ research efforts.

On Track

The Department of State’s Global Engagement Center (GEC) provides grants to nonprofit institutions to research Russian propaganda and other disinformation-related topics. The National Science Foundation (NSF) has also previously provided grant funding for disinformation research. As originally envisioned by the Commission, implementing this recommendation would require Congress to authorize and appropriate funds for a grant program within the Department of Justice. However, Congress could achieve the intent of this recommendation through GEC, NSF, or other grant programs, provided they are sufficiently funded.

PAN 1.4.1

Pandemic (PAN)

White Paper

Establish the Social Media Data and Threat Analysis Center

'21

'22

'23

'24

This is some text inside of a div block.

View Details

SC 1

Supply Chain (SC)

White Paper

Develop and Implement an ICT Industrial Base Strategy

'21

'22

'23

'24

This is some text inside of a div block.

View Details

This is some text inside of a div block.

SC 1

Heading

White Paper

2021

2022

2023

Identify Key ICTs and Materials

'21

'22

'23

'24

This is some text inside of a div block.

View Details

SC 3

Supply Chain (SC)

White Paper

Conduct a Study on the Viability of Critical Technology Clusters and Designate Them

'21

'22

'23

'24

This is some text inside of a div block.

View Details

This is some text inside of a div block.

SC 3

Heading

White Paper

2021

2022

2023

Provide Research and Development Funding for Critical Technologies

'21

'22

'23

'24

This is some text inside of a div block.

View Details

This is some text inside of a div block.

SC 3.1

Heading

White Paper

2021

2022

2023

Incentivize the Movement of Critical Chip and Technology Manufacturing out of China

Cyberspace Solarium Commission Recommendations Tracker

Implementation Status

Related Links

Breakdown by Pillars

Pillar 1

Pillar 2

Pillar 3

Pillar 4

Pillar 5

Pillar 6

White Papers

Pillar 1

Pillar 2

Pillar 3

Pillar 4

Pillar 5

Pillar 6

White Papers

Pillar 1

Pillar 2

Pillar 3

Pillar 4

Pillar 5

Pillar 6

White Papers

Pillar 1

Pillar 2

Pillar 3

Pillar 4

Pillar 5

Pillar 6

White Papers

LAYER 2 - DENY BENEFITS

Pillar 1

Pillar 2

Pillar 3

Pillar 4

Pillar 5

Pillar 6

White Papers

Assessment Data

Show Filters

Hide Filters

1.1

1

2020 Report

Issue an Updated National Cyber Strategy

'21

'22

'23

'24

1.1

Heading

2020 Report

Issue an Updated National Cyber Strategy

Nearing Implementation

Nearing Implementation

Implemented

Implemented

1.1.1

1

2020 Report

Develop a Multitiered Signaling Strategy

'21

'22

'23

'24

1.1.1

Heading

2020 Report

Develop a Multitiered Signaling Strategy

On Track

On Track

Implemented

Implemented

1.1.2

1

2020 Report

Promulgate a New Declaratory Policy

'21