A National Cybersecurity Strategy Is Coming. Are You Prepared?
Upcoming policy illustrates that government is taking cyber threat seriously
National Cyber Director Chris Inglis has said the Biden Administration plans to release a national cybersecurity strategy this year, perhaps as early as the end of this month. The strategy, and the corresponding efforts of Inglis, aim to “more forcefully use government power in the cyber arena,” according to reports.
Without seeing the actual proposed policy, whether this explicitly means expanded government oversight related to cybersecurity protections of the nation, an increased regulatory response — or both — is not yet clear. Regardless, it can be expected that the desires of the U.S. government and President Joe Biden are to take the genuine cybersecurity threat more seriously and offer a more active role in helping organizations, both in the public and private space, combat cyber attacks.
What this means for organizations
Industry tends to follow government guidance. Even if Inglis’ strategy does not directly impact specific industries, it is likely that the private sector will look to introduce similar standards. This may not happen immediately, but it would be wise for organizations across all industries to anticipate increased expectations for their cybersecurity preparedness programs. Instead of waiting to see what happens, organizations should work to get ahead of potential demands.
Ignorance is not an acceptable excuse. If an organization lacks basic cybersecurity controls needed to protect critical assets — customer information, intellectual property, etc. — then they can be held responsible for any resulting damages. The expectation from the government and the public is that organizations are doing everything in their power to mitigate cyber risk.
Audits and requirements will increase. Increased government oversight and involvement likely means additional audits, new compliance requirements and baseline standards. In preparation, organizations should evaluate their cybersecurity processes and programs to identify gaps and vulnerabilities. This will reduce potential government penalties and better position organizations to deter and respond to cyber attacks.
Meeting demands will be challenging. The national cybersecurity strategy is expected to be “tough” and demanding. Without a dedicated team and plan of attack for assessing and improving programs and processes, organizations will be faced with answering challenging questions from regulators, stakeholders and customers, negatively impacting their viability and reputation.
Potential outcomes
Ultimately, a national cybersecurity strategy is a positive development. In theory, increased supervision and participation from the government will keep organizations honest about their cybersecurity efforts and hold them responsible for their protective measures. This should also have the corresponding effect of making organizations more resilient to attacks, which would positively impact larger cybersecurity issues, like reducing successful ransomware campaigns. SOURCE