New Cyber Policy Priorities Outlined by the US Cyberspace Solarium Commission

The US Cyberspace Solarium Commission (CSC) has released its latest assessment, highlighting ten new policy priorities that aim to fortify the nation’s cybersecurity landscape. This report comes amid growing concerns over cyber threats to national critical infrastructure, with a sharp increase in both nation-state adversary attacks and criminal ransomware activities. The 2024 Annual Report underscores that while 80% of the recommendations from the 2020 CSC report have been implemented, there is still a significant need for further action as the US government faces evolving cyber threats.

Key Cybersecurity Threats and Challenges

The CSC’s 2024 report emphasized the increasing cyber threats from both foreign state actors, like China, and cybercriminals. China’s recent “Volt Typhoon” cyberattacks are of particular concern, highlighting the vulnerability of the US’s highly networked infrastructures. Additionally, ransomware attacks surged by 74% in 2023, putting immense pressure on both public and private sectors. These cyber threats have exposed gaps in the security of critical infrastructure, which the CSC has been working to address through various legislative and policy measures since 2020.

Achievements and Implementation Progress

As of 2024, a majority of the CSC’s initial recommendations have been acted upon, primarily through legislative efforts and administrative actions. About 12% of the remaining recommendations are on track to be fully implemented. This progress has been driven by the executive branch’s leadership, spearheaded by the Office of the National Cyber Director (ONCD) and other key agencies like the Cybersecurity and Infrastructure Security Agency (CISA). The ONCD, led by National Cyber Director Harry Coker, has played a vital role in executing the National Cybersecurity Strategy outlined in 2023.

Top 10 Cybersecurity Policy Priorities for 2025

The CSC’s 2024 report outlines ten new priorities for the incoming US administration and Congress. These recommendations build on the progress made but also reflect the new cyber landscape shaped by emerging threats:

1. Establishing Clear Parameters for Systemically Important Entities (SIEs): The CSC calls for enhanced regulations and protections for entities critical to national security, such as financial institutions and energy companies.
2. Joint Collaborative Environment (JCE): A major focus is the creation of a JCE that facilitates better public-private coordination on cybersecurity threats. CISA’s Joint Cyber Defense Collaborative (JCDC) is a model for this effort.
3. Enhanced Public-Private Partnerships: Recognizing the role of private companies in managing critical infrastructure, the report stresses the need for stronger collaboration between the government and private sector.
4. Addressing Workforce Gaps: The cyber workforce remains critically understaffed. Priorities include expanding training programs and incentives for cybersecurity professionals.
5. Modernizing Federal Cyber Defenses: There is a call for updated technology across federal agencies to protect against sophisticated threats.
6. Strengthening Incident Reporting: The Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) is a key tool for ensuring timely threat reporting. The Commission stresses the importance of completing rulemaking and ensuring compliance.
7. Improving Cyber Diplomacy: The State Department’s Bureau of Cyberspace and Digital Policy has made strides in cyber diplomacy, but more needs to be done to collaborate with international allies.
8. Ensuring Adequate Cyber Funding: While CISA’s budget has doubled over the past five years, inconsistencies in federal agency funding remain a challenge. The CSC calls for more uniform financial support.
9. Fostering Innovation in Cybersecurity: Encouraging innovation, particularly in emerging technologies like artificial intelligence and quantum computing, is crucial for staying ahead of adversaries.
10. Combatting Ransomware and Cybercrime: With the rise in ransomware attacks, the CSC emphasizes the need for stronger legal frameworks and international cooperation to tackle cybercrime.

Future Legislative and Policy Efforts

While the CSC’s recommendations have driven considerable legislative and policy advancements, the road ahead will require continued collaboration across government agencies and the private sector. Congress has already strengthened the foundations of cybersecurity in key areas, including the 2022 CIRCIA law and fiscal appropriations. However, gaps remain, particularly in terms of ensuring uniform funding for all sector risk management agencies.

The report also highlights the need for global partnerships in tackling the cyber threat landscape. The State Department has made significant strides in cyber diplomacy, releasing its first-ever U.S. International Cyberspace and Digital Policy Strategy in 2024. This initiative seeks to advance U.S. interests in global cyber forums and help allies build their cyber defenses.

Conclusion

As the cybersecurity landscape continues to evolve, the CSC’s new recommendations provide a clear roadmap for the incoming administration and Congress. The focus on public-private collaboration, workforce development, cybercrime prevention, and critical infrastructure protection is key to building a resilient and secure national cybersecurity posture. The ongoing leadership of agencies like the ONCD and CISA will be crucial in implementing these priorities and addressing the dynamic cyber threats facing the United States.

Sources:

• Inside Cybersecurity, September 2024​(Inside Cyber Security).
• Cyberspace Solarium Commission, 2024 Annual Report​(CSC 2.0).