Back when cybersecurity was in its infancy — about two decades ago — simply discovering that an incident had occurred was considered a major victory inside an organization. As cybersecurity matured, forensic advances made it possible for organizations to identify the very source of the incident — even if the investigation was drawn out and exact details were often fuzzy.
Today, we have reached a stage where cyber attacks and other crimes are increasingly discovered, monitored and resolved by the business community. Given how rapidly cybersecurity technology develops, President Biden believes the time is right to leverage organizational intel to help protect and defend our nation’s critical infrastructure going forward.
In March, the Biden Administration unveiled its National Cybersecurity Strategy, a comprehensive proposal that leans heavily on the private sector.1 The White House press release makes plain the government’s objective: “We must rebalance the responsibility to defend cyberspace by shifting the burden for cybersecurity away from individuals, small businesses and local governments, and onto the organizations that are most capable and best positioned to reduce risks for all of us.”2
The proposal asks a lot of the cybersecurity industry, which will now be required to implement security standards into the applications made by tech firms. For software manufacturers in particular, this shift is a sea change in risk management. For the first time, developers will be liable if a software vulnerability or a bad line of code results in a cybersecurity incident — not unlike the way automakers and other manufacturers are responsible for design flaws when they lead to consumer harm.
Getting a head start on implementing basic requirements of the National Cybersecurity Strategy (the “Strategy”) can limit cybersecurity risk, achieve compliance and save tech firms headaches and unnecessary costs down the road.
