CSC: Cyber Policy Recommendations Could be Included in Next NDAA

The next National Defense Authorization Act could include about 30 percent of the Cyberspace Solarium Commission's recommendations on cybersecurity policy, according to a co-chairman of the commission. 

Rep. Mike Gallagher said the CSC is working with relevant congressional committees and subcommittees to implement its recommendations, which includes more than 80 points on cyber policy.

The CSC's March 11 report proposed a layered cyberattack deterrence strategy that involves shaping behavior, denying benefit and imposing costs, Fifth Domain reported Thursday. 

Gallagher did not identify which recommendations he expects to be included in the NDAA. However, Fifth Domain said the likeliest ones will be those directed at the Department of Defense because of the bill's focus on authorizing Pentagon programs.

According to the chairman, the coronavirus pandemic has both delayed the government's cyber efforts and highlighted the need to implement the CSC's recommendations. 

The commission's suggestions are divided into six "pillars": reforming the government's cyberspace structure and organization, strengthening norms and non-military tools, promoting national resilience, reshaping the cyber ecosystem, operationalizing private-sector collaboration and preserving the military instrument of national power.

CSC said its recommendations were based on an extensive study of over 300 interviews, the creation of a strategy modeled after the Eisenhower administration's Project Solarium and the results of stress tests by external red teams.  

“The current state of affairs invites aggression and establishes a dangerous pattern of actors attacking the United States without fear of reprisal," the report's executive summary read.