Solarium Cyber Report Recommends New Government Structures, Major Policy Overhauls

One of the congressionally-mandated Cyberspace Solarium Commission’s 80 recommendations is for Congress to create a Bureau of Cyber Statistics within the Commerce Department to better inform policymaking.

The commissioners are open to another department or agency housing the bureau, but wherever it’s located, it would collaborate with Commerce’ National Institute of Standards and Technology in “identifying and establishing meaningful metrics and data necessary to measure cybersecurity and risk reduction in cyberspace.”

Throughout the ecosystem, members of the public and private sectors, including senior Cybersecurity and Infrastructure Security Agency officials, have regarded metrics in the space difficult to establish. The idea is that it’s hard to tell if entities are making progress defending their systems by noting whether or not they have been breached. They might simply not have been attacked. 

But as more entities acknowledge they are constantly under attack, the focus on metrics throughout the report bucks that thinking. Asking more granular questions of private companies and government agencies could establish greater accountability.

A new law would empower the cyber statistics bureau to collect the appropriate data from relevant departments and agencies, “as well as companies that regularly collect cyber incident data as a part of their business.” 

These entities would be “required to provide aggregated, anonymized, minimized data on cyber incidents to inform statistical analysis on a yearly basis,” according to the report.

The report additionally recommends Congress amend the Sarbanes-Oxley Act to include cybersecurity reporting requirements. 

Congress passed the Sarbanes-Oxley Act in 2002 to improve corporate accountability through the Securities and Exchange Commission’s enforcement of disclosures by publicly traded companies.

“Specify corporate responsibility requirements for the security of information systems, including the metrics and records publicly traded companies must keep regarding risk assessments, determinations, and decisions; cyber hygiene; and penetration testing and red-teaming results, including a record of metrics relating to the speed of their detection, investigation, and remediation,” the report reads.

The 182-page report is chock-full of details around recommendations, some of which have been circulated for as long as cybersecurity has been a policy area. 

It calls for Congress to pass national breach notification and privacy legislation, for example. But leaders of the Senate Commerce Committee such as Chairman Roger Wicker, R-Miss., and Sen. John Thune, R-S.D., the majority whip, recently told reporters there’s currently no path forward on such legislation. 

The report attempts to shift some of the dynamics that have stymied such efforts by streamlining the multitude of committees with a stake—and oversight authority—in cybersecurity. It recommends the jurisdiction rest with new permanent select committees on cybersecurity in the House and Senate. 

The commission’s report has received generally positive reviews from industry.

“Not everyone will like every recommendation the Commission produced, but our hope is that the report will create a sense of urgency for Congress to take meaningful, bipartisan action in this arena,” said Tommy Ross, Senior Director, Policy at BSA | The Software Alliance. “The Cyberspace Solarium Commission has produced serious, forward-leaning recommendations that would, collectively, help the United States Government and U.S. critical infrastructure better defend against advanced cyber threats.”

But observers are well aware of the challenge implementing the recommendations will involve.

“The report hits the bulls-eye on the biggest executive branch hurdles to addressing cyber risk by focusing on the limitations for cross-sector agency support; existing imitations for how DHS and [the Defense Department] can currently work with the private sector and advocates for expanded administrative subpoena power for the FBI and the Secret Service with new authorities for [the Defense Information Systems Agency],” said Norma Krayem, a senior nonresident associate of the Center for Strategic and International Studies’ Homeland Security and Counterterrorism Program. 

Krayem, a former official at the departments of State, Commerce, and Transportation, said the report  “greatly expands, through the creation of the Joint Collaborative Environment, a new near mandate on information sharing.”

“However,” she said, “substantial resources will be needed to build out this capability in the government as well as extensive outreach with the private sector to achieve support for the recommendations.”