Presidential Cybersecurity Commission Issues Ambitious Policy Roadmap For Next Administration

On Thursday, December 1, the nonpartisan Commission on Enhancing National Cybersecurity, established pursuant to an Executive Order in February, issued its report, outlining more than 50 recommendations for the next Administration.1 Among the most striking are calls for:

regulatory agencies to "harmonize existing and future regulations with the National Institute of Standards and Technology (NIST) Cybersecurity Framework to focus on risk managementreducing industry's cost of complying with prescriptive or conflicting regulations that may not aid cybersecurity and may unintentionally discourage rather than incentivize innovation"; the federal government to "extend additional incentives to companies that have implemented cyber risk management principles and demonstrate collaborative engagement"; development by a private body of "the equivalent of a cybersecurity 'nutritional label' for technology products and servicesideally linked to a rating system of understandable, impartial, third-party assessment that consumers will intuitively trust and understand"; creation by Executive Order of a "National Cybersecurity Private-Public Program (NCP3) as a forum for addressing cybersecurity issues through a high-level, joint public-private collaboration"; establishment of a "Cybersecurity Framework Metrics Working Group (CFMWG) to develop industry-led, consensus-based metrics that may be used by (1) industry to voluntarily assess relative corporate risk, (2) the Department of Treasury and insurers to understand insurance coverage needs and standardize premiums, and (3) DHS to implement a nationwide voluntary incident reporting program for identifying cybersecurity gaps, including a cyber incident data and analysis repository (CIDAR)"; rapid development, under NIST's leadership, working with industry and voluntary standards organizations, of a comprehensive set of risk-based security standards for Internet of Things (IoT) devices and systems; launching of a "national public-private initiative to achieve major security and privacy improvements by increasing the use of strong authentication to improve identity management"; recognition that the federal government "isand should remainthe only organization with the responsibility and, in most cases, the capacity to effectively respond to large-scale malicious or harmful activity in cyberspace caused by nation-states, although often with the assistance of and in coordination with the private sector"; and...