No private company can face the monumental cybersecurity challenge alone. Now is the time for the public and private sectors to step up their collective efforts to improve nations’ cybersecurity for decades to come. The Charter of Trust is one of the key platforms to achieve this.
by Jonathan Sage, Cybersecurity Policy Europe, IBM
As our dependency on technology continues to grow so will the scale and sophistication of cybersecurity threats. For businesses, the intensification of cybercrime can be explained by Sutton’s law: that’s where the money is. The cost of cybercrime – already in the billions of dollars – rises each year and continues to increase in frequency, scope, and severity of impact.
While some attacks are costly and inconvenient, others can be crippling. With cybersecurity quickly becoming a new battleground for state competition, businesses and government share a collective responsibility to collaborate on preventing cyberattacks that could have a devastating impact or prompt national or global crises. We must join forces now to shore up the security of the critical infrastructure that keeps our society functioning.
As a leading enterprise security firm, IBM is uniquely positioned to help. Our teams use cloud and AI-powered software to manage 150 billion cybersecurity events each day for more than 17,000 commercial and government clients worldwide. Drawing on this breadth of expertise and capabilities, IBM is ready to do its part to help build enduring cybersecurity.
In a recent meeting with U.S. President Biden and members of his Cabinet, IBM’s Chief Executive, Arvind Krishna had in-depth discussions on how America’s digital defenses can be strengthened, making five key commitments that IBM is pledging to help address this imperative, which align well with IBM’s engagement as a founding member of the Charter of Trust:
1. Building a more robust and diverse cyber workforce
With nearly 500,000 unfilled cybersecurity jobs across the U.S. (Source: NIST), IBM is going to help prepare more American students and workers for those vital roles by training more than 150,000 people in cybersecurity skills over the next three years through a range of programs, such as SkillsBuild. Workforce issues, training and diversity are key elements in the Charter of Trust’s Principle 6, “Education”. We also will partner with more than 20 Historically Black Colleges & Universities to establish Cybersecurity Leadership Centers to build a more diverse U.S. cyber workforce.
2. Measuring progress and results
We need to go beyond cybersecurity commitments and focus on measuring tangible progress and results. Measurement tools already exists in Environmental, Social, and Governance (ESG) reporting. In line with Principle 1 of the Charter of Trust, “Ownership for cyber and IT security”, IBM is calling for the establishment of voluntary public reporting standards on cybersecurity practices. We believe the cyber framework developed by the National Institutes of Standards and Technology (NIST) could serve as a strong starting point for building such a reporting system.
3. Protecting critical infrastructure
Dealing with a cybersecurity crisis is a matter of when, not if. To help critical infrastructure organizations better prepare for and recover from ransomware attacks, we are announcing IBM Safeguarded Copy—a new data storage solution that can shorten the time it takes for organizations to recover from days to hours. IBM is already working with industries that operate critical infrastructure and will expand this offering to other clients.
4. Accelerating quantum-safe cryptography
While quantum computers will help solve new categories of problems that are beyond the reach of even today’s most powerful traditional computers, they will also make our current encryption methods obsolete. As we prepare for a quantum world, IBM is committed to developing and deploying new, quantum-safe encryption methods such as lattice-based cryptography.
5. Securing the Technology Supply Chain
Finally, IBM participates in an effort led by the National Institute of Standards and Technology (NIST) to develop a comprehensive framework to improve the security of the technology supply chain, reflecting the goal in Principle 2 of the Charter of Trust, “Responsibility throughout the digital supply chain”. This work builds on IBM’s engagement with NIST on software supply chain security following the U.S. President’s recent cybersecurity executive order, and it also will include a focus on open-source technology in which IBM has decades of expertise.
Protecting the digital economy: A concerted effort
As we have seen in just the past few months, cyberattacks can cause widescale disruption, economic upheaval, and even physical damage. If nothing is done, future attacks could become even more destructive and impact the power, transport, and communications systems we all depend upon to live and work.
IBM is already taking action on many fronts to protect the digital economy – from keeping our data secure, to helping cyber-defenders become as collaborative as cybercriminals, to inspiring a new generation to pursue careers in cyber, and more.
That said, no private company can face this monumental challenge alone. Now is the time for the public and private sectors to step up their collective efforts to improve nations’ cybersecurity for decades to come. The Charter of Trust is one of the key platforms to achieve this.
PREVIOUS POST
Cybersecurity Awareness Month
NEXT POST
Contribution to the EU Commission Public Consultation on the revision of the Cybersecurity Act
You may also like
External Engagement
Contribution to the EU Commission Public Consultation on the revision of the Cybersecurity Act
The Charter of Trust welcomes the opportunity to participate in the European Commission’s public consultation on the revision of the Cybersecurity Act. As a coalition united by the goal of strengthening digital trust, we are pleased to share our consolidated response and recommendations.
We support Policy Option 2, which focuses on targeted regulatory measures that address key challenges without creating unnecessary complexity. In this context, we emphasize the need to enhance the role and resources of ENISA, to ensure effective implementation of both current legislation and the European Cybersecurity Certification Framework (ECCF).
Our recommendations aim to improve transparency, collaboration, and efficiency across the EU’s cybersecurity landscape. These include:
- Introducing clear timelines for the development of certification schemes.
- Enhancing stakeholder engagement throughout the process.
- Establishing more structured communication channels between ENISA, the Stakeholder Cybersecurity Certification Group (SCCG), and sectoral ISACs (Information Sharing and Analysis Centers).
We call for a stronger ECCF, one that is transparent, inclusive, and aligned with international standards to foster global interoperability and ease compliance for organizations across borders. Equally critical is the harmonization of certification practices across EU member states and the mutual recognition of certifications to minimize regulatory fragmentation.
The Charter of Trust advocates for technically robust, standards-based certification schemes, with well-defined roles and responsibilities. We also stress the need for clarity on the interplay between voluntary and mandatory certifications, particularly in relation to the upcoming Cyber Resilience Act (CRA).
To streamline compliance and reduce administrative burden, we propose a unified, risk-based incident reporting regime that consolidates requirements under regulations such as NIS2, CRA, GDPR, and DORA. This would not only simplify reporting for organizations but also enhance the EU’s overall cyber resilience. In addition, we recommend incorporating liability protections and grace periods for incident disclosure.
Finally, we urge the Commission to strengthen supply chain security by adopting a risk-based classification approach and establishing baseline cybersecurity requirements for ICT suppliers.
The Charter of Trust remains fully committed to supporting the European Commission in shaping a secure, resilient, and trusted digital future for Europe. We look forward to continued collaboration in building a cybersecurity framework that meets the needs of all stakeholders, today and in the years to come.
We support Policy Option 2, which focuses on targeted regulatory measures that address key challenges without creating unnecessary complexity. In this context, we emphasize the need to enhance the role and resources of ENISA, to ensure effective implementation of both current legislation and the European Cybersecurity Certification Framework (ECCF).
Our recommendations aim to improve transparency, collaboration, and efficiency across the EU’s cybersecurity landscape. These include:
- Introducing clear timelines for the development of certification schemes.
- Enhancing stakeholder engagement throughout the process.
- Establishing more structured communication channels between ENISA, the Stakeholder Cybersecurity Certification Group (SCCG), and sectoral ISACs (Information Sharing and Analysis Centers).
We call for a stronger ECCF, one that is transparent, inclusive, and aligned with international standards to foster global interoperability and ease compliance for organizations across borders. Equally critical is the harmonization of certification practices across EU member states and the mutual recognition of certifications to minimize regulatory fragmentation.
The Charter of Trust advocates for technically robust, standards-based certification schemes, with well-defined roles and responsibilities. We also stress the need for clarity on the interplay between voluntary and mandatory certifications, particularly in relation to the upcoming Cyber Resilience Act (CRA).
To streamline compliance and reduce administrative burden, we propose a unified, risk-based incident reporting regime that consolidates requirements under regulations such as NIS2, CRA, GDPR, and DORA. This would not only simplify reporting for organizations but also enhance the EU’s overall cyber resilience. In addition, we recommend incorporating liability protections and grace periods for incident disclosure.
Finally, we urge the Commission to strengthen supply chain security by adopting a risk-based classification approach and establishing baseline cybersecurity requirements for ICT suppliers.
The Charter of Trust remains fully committed to supporting the European Commission in shaping a secure, resilient, and trusted digital future for Europe. We look forward to continued collaboration in building a cybersecurity framework that meets the needs of all stakeholders, today and in the years to come.
Read more
June 19, 2025
•
External Engagement
Advancing Regulatory Alignment at RSA Conference 2025
In the face of rising global cyber threats, over 50 CISOs have called for greater international alignment of cybersecurity regulations to strengthen defenses and reduce fragmentation. This message was echoed at RSAC 2025, where experts from the OECD, European Commission, academia, and industry emphasized the need for principle-based collaboration. The Charter of Trust, a long-time advocate for regulatory harmonization, continues to support coordinated, effective approaches that prioritize clarity over complexity.
Read more
May 01, 2025
•
External Engagement
Richards Skalt takes over the Advocacy Workstream
We are delighted to welcome Richard Skalt, Advocacy Manager at TÜV SÜD, as the new Leader of the Advocacy Workstream at the Charter of Trust. Richard steps into the role following María del Pino González-Junco, who recently assumed the position of Chair of the Global External Engagement Working Group.
With a strong background in advocacy and a forward-looking vision, Richard brings renewed energy to our mission of shaping a secure digital future. As he puts it:
“My motivation is to preserve and build upon the strong foundation of advocacy activities we’ve developed over the past years. At the same time, I’m committed to ensuring we’re in a position to shape the policies that will define how our business model and operations evolve in the future – including the cybersecurity of products and systems, the use, deployment, and distribution of robust AI solutions, as well as cloud security and secure datacenters.”
In a world defined by accelerating digital transformation and increasingly complex regulatory challenges, principled leadership and effective collaboration are more vital than ever. Under Richard’s leadership, the Advocacy Workstream will continue to engage policymakers, raise public awareness, and strengthen education around key issues such as cybersecurity, AI governance, and secure digital infrastructures.
With a strong background in advocacy and a forward-looking vision, Richard brings renewed energy to our mission of shaping a secure digital future. As he puts it:
“My motivation is to preserve and build upon the strong foundation of advocacy activities we’ve developed over the past years. At the same time, I’m committed to ensuring we’re in a position to shape the policies that will define how our business model and operations evolve in the future – including the cybersecurity of products and systems, the use, deployment, and distribution of robust AI solutions, as well as cloud security and secure datacenters.”
In a world defined by accelerating digital transformation and increasingly complex regulatory challenges, principled leadership and effective collaboration are more vital than ever. Under Richard’s leadership, the Advocacy Workstream will continue to engage policymakers, raise public awareness, and strengthen education around key issues such as cybersecurity, AI governance, and secure digital infrastructures.
Read more
April 29, 2025
•
