Charter of Trust » Advancing Regulatory Alignment at RSA Conference 2025

In the face of rising global cyber threats, over 50 CISOs have called for greater international alignment of cybersecurity regulations to strengthen defenses and reduce fragmentation. This message was echoed at RSAC 2025, where experts from the OECD, European Commission, academia, and industry emphasized the need for principle-based collaboration. The Charter of Trust, a long-time advocate for regulatory harmonization, continues to support coordinated, effective approaches that prioritize clarity over complexity.

In response to growing cyber threats, governments worldwide are introducing an increasing number of cybersecurity laws and regulations or updating existing ones. These efforts help ensure organizations across the ecosystem prioritize security. At the same time, without coordination, an increasingly fragmented regulatory landscape risks undermining the very resilience regulators seek to strengthen.

On April 23, 2025, a group of over 50 Chief Information Security Officers (CISOs) released a joint letter they had signed to highlight the need for greater alignment and reciprocity of cybersecurity regulations internationally and across sectors to maximize stronger cyber defenses. They also encouraged G7 and OECD member states to make this a priority and to leverage the OECD to drive greater alignment moving forward.

At RSAC last week, a panel of experts, moderated by Charter of Trust member Microsoft’s Tim Maurer, tackled this urgent challenge. The session featured Florian Schütz from the Swiss National Cybersecurity Centre and chair of the OECD Working Party on Digital Security, Christiane Kirketerp de Viron from DG Connect, Ari Schwartz from Venable LLP, and Josephine Wolff from Tufts University. Together, they explored how today’s regulations are reshaping operational cyber defense.

One clear takeaway from the panel at RSA is that the participants agreed on the need for greater alignment and simplification. As Florian Schütz emphasized, “We will never agree on everything globally—and that’s okay… But we need to find common ground. The OECD is a useful vehicle because it’s principle-based—it doesn’t prescribe how to regulate but outlines recommended approaches and shared principles.” His remarks echo the Charter’s view that harmonization does not mean uniformity—but clarity, coordination, and collaboration. Christiane Kirketerp de Viron highlighted the European Commission’s work on greater simplification and Ari Schwartz outlined specific suggestions what issues could be prioritized in response to some of the gaps and divergence Professor Wolff has identified as part of her research.

The Charter of Trust has long advocated for a more coherent and aligned international approach to cybersecurity regulation. Our 2024 paper, Harmonising Regulations – A Charter of Trust Perspective, highlights key friction points in the current landscape including divergent definitions, conflicting reporting timelines, and an associated increase in operational cost and complexity.

We are encouraged by the positive response to the CISO letter and welcome the OECD’s role as a forum for principle-based collaboration. The Charter of Trust continues to support this momentum and work with partners to advance smarter, more effective cybersecurity regulations.