As the United States begins a new chapter politically, this is an important moment for US leaders to evaluate and potentially reposition the nation’s cybersecurity policies. Cybersecurity should be among the top issues addressed first and consistently over the next four years.

This policy focus is essential as we continue to uncover and comprehend the impacts of the SolarWinds cyberattack. From bolstering the role of the US Cybersecurity and Infrastructure Security Agency (CISA) to taking critical steps to protect US infrastructure and supply chains to building a pipeline of advanced cybersecurity professionals, these critical policy areas must be central to the nation’s agenda going forward.

The members of the Charter of Trust – an international alliance of corporations and organizations committed to enabling trust in digital technologies – urge US government officials to align their policy priorities with several core principles that emphasize the need to prioritize cybersecurity laws, protections measures and education.

Ownership

Principle One of the Charter of Trust establishes that responsibility for cybersecurity should be appropriately designated throughout an organization with proper accountability in management. Aligned with that principle, we are encouraged by congressional action, via the recently passed National Defense Authorization Act (NDAA), which creates a “National Cyber Director” role within the White House.[1]  We expect this new leadership role will pave the way for improved and streamlined threat intelligence with sharing of information across government agencies and with industry. This same legislation expands the role and responsibilities of CISA, a crucial step in protecting critical infrastructure in the United States. We anticipate that the new US administration will continue to encourage expansion of CISA resources, responsibilities and partnership with the private sector moving forward. These are all positive developments that will strengthen US national security as well as the security of the economy and critical infrastructure. We encourage government leaders at both ends of Pennsylvania Avenue to make cybersecurity an ongoing and sustained policy priority.

Supply Chain Security

Principle Two states that companies and – if necessary – governments must establish risk-based rules beyond the proposed Baseline Cybersecurity Supply Chain Requirements[2] to ensure adequate protection across the digital supply chain. For critical infrastructures such as the US power grid and other critical IoT solutions the Charter of Trust advocates for independent certification in its Principle Seven. As was observed in the recent high-profile SolarWinds attacks, third-party and fourth-party cyber risk management has never been more important. It is imperative for organizations to have visibility into the cybersecurity measures of their key vendors. Aligned to what we’ve developed in our white paper on supply chain security, the Charter of Trust is confident that CISA will continue and expand on its work as the nation’s cyber risk management advisor providing organizations with guidance and frameworks for assessing third-party risk. Tactically, this includes promoting standards across secure software development and engaging in a coordinated, improved approach to vulnerability management.

Education

Principle Six of the Charter calls on academia to expand dedicated cybersecurity courses in school curricula, helping to build a diverse talent base. There is a serious deficit in cyber talent pipeline, in large part due to the lack of educational opportunities. Additionally, there are known challenges in the cybersecurity field to properly identify, recruit and retain talent, especially women and minority groups. Meanwhile, estimates indicate there will be more than three million cybersecurity jobs unfilled just this year[3]. Recognizing the magnitude of the challenge, we encourage the administration to proactively address this shortfall through both creative and traditional means, including adjustments to immigration policy related to high-skilled cyber talent and providing dedicated funding to STEM education, especially in high schools and community colleges.

Security by default

Principle Three of the Charter calls for the adoption of the highest appropriate level of security and data protection, highlighting the need to ensure that security and data protection are preconfigured into the design of products, functionalities, processes, technologies, operations, architectures, and business models.  As industrial production – especially in the technology and mobility sectors – continues to recover in the wake of the pandemic, security by default is now more essential than ever.  We encourage and anticipate further discussion on device-based security standards – including the IoT Security Act of 2020 – when contemplating next steps in crafting more advanced, flexible cybersecurity principles.

International Norms and Leadership

Perhaps the most impactful cybersecurity actions government officials can undertake is to regain and reassert US leadership in cyberspace. We recognize that success will require global support and joint initiatives between industry, governments, academia and research organizations, as laid out in both Principle 10 of our Charter of Trust and its Joint Initiatives and Associate Partner Forum, which support a collaborative approach between these three important stakeholder groups. To also strengthen the global digital supply chain for the US industry harmonization of standards and requirements with other regions shall become a priority of the new administration.

 

Cybersecurity is at the core of national defense, future stability and economic growth. Its importance should not be underestimated or placed down the list of highest governmental priorities. The members of the Charter of Trust stand by to help inform and support these policy actions.

 

[1] Congressional backers cite cybersecurity provisions as they push Trump to sign defense bill – CNNPolitics

[2] Charter of Trust Baseline Cybersecurity Supply Chain Requirements

[3] The Mad Dash to Find a Cybersecurity Force – The New York Times (nytimes.com)

You may also like

UK/EU Summit - “Risk to Resilience”
icon External Engagement

UK/EU Summit - “Risk to Resilience”

Detlef Houdeau, Senior Director, Business Development at Infineon Technologies was a speaker at the inaugural UK/EU Summit organized by our newest Associated Partners Shared Assessments.

💡Under the theme “Risk to Resilience” the first event of this series was held in London and brought together professionals from different industries and regions. Detlef participated in the panel about the complex regulatory landscape and emphasized that new legislation like the EU AI Act, DORA and Hashtag#NIS2 continue to push the standard of care on cybersecurity and other risks.

Thanks to Shared Assessments for organizing such an amazing event and inviting the Charter of Trust to participate in this high-class panel alongside Andrew Moyad, CEO at Shared Assessments.
October 08, 2024
36th Cyber Security Day: Working together for more resilience in the digital future
icon External Engagement

36th Cyber Security Day: Working together for more resilience in the digital future

Strong networks and effective cooperation are the key to successfully shaping the digital future in Germany. Cybersecurity is a team effort, and that was again visible last week at the 36th Cyber Security Day in Berlin.

🌐On 26 September 2024, the Bundesamt für Sicherheit in der Informationstechnik (BSI), Alliance for Cyber Security, and the DIHK invited experts, companies, authorities and political decision-makers to jointly strengthen Germany's cyber resilience.

The event was a great mix of policy debate, practical exchange, workshop and networking under the motto ‘Stronger Together: Greater Resilience through Cooperation’.

✨ One of the highlights of the day was the closing panel with Claudia Plattner, President of the BSI, Dr. Stefan Saatmann, Deputy Head Berlin Office at Siemens, Konstantin von Notz, Member of the Bundestag for B90/Greens, and Alexander von Gernler, German Informatics Society, interchanging ideas to foster resilience through collaboration. Initiatives like the CoT baseline requirements and its huge potential for international harmonizing cybersecurity regulations were discussed as well.

Let’s all work together so that closer cooperation between the BSI and businesses bring more tangible effects to increase digital resilience. Special thanks to Nils Hasenau for providing the excellent photos and also to Simon Ulmer and Ralf König for attending the event.
October 01, 2024
Nordic Cyber Summit 2024
icon External Engagement

Nordic Cyber Summit 2024

The Charter of Trust at the Nordic Cyber Summit
What a great opportunity for Morten Kromann, Head of Industrial Security Denmark at Siemens, to present the Charter of Trust perspective on cybersecurity regulations like Hashtag#NIS2 at the Nordic Cyber Summit in Copenhagen.

This year the summit was again a formidable event to engage with top cybersecurity experts, share insights, and discuss strategies to navigate the ever-evolving threat landscape in the Nordic region with the theme “Fortifying the Future: Building Cyber Resilience in a Transformed World”.

A main aspect highlighted by Morten was the discrepancies between the NIS2 directive’s incidents reporting timeframe and related provisions adopted in other legislations. These regulatory overlaps create difficult compliance environments for industry and costly operational pressures which add to the fragmentation of the market instead of harmonizing it. That is why the Charter of Trust emphasizes streamlining reporting requirements stemming from these different legislative frameworks and developing single entry points for reporting on the national level.

These and more points will also be discussed during our next Security-by-default Webinar taking place on the 29th of October. Sign up to find out more what the Charter of Trust Partners views are on how to prepare for NIS2 and other regulations: https://lnkd.in/eh_z8Z63
September 16, 2024