Thread by @ericgeller

The congressionally chartered Cyberspace Solarium Commission released its long-awaited report today at solarium.gov.

The report makes more than 75 recommendations to reorganize and improve govt cyber functions & strengthen private-sector security.

A few highlights...

First up, the big structural reforms. The report recommends creating an Office of the National Cyber Director inside the White House, creating cybersecurity committees to consolidate oversight, and reviving Congress's Office of Technology Assessment.

The report also suggests promoting @CISAgov's director to the equivalent of a deputy Cabinet secretary and floats the idea of turning the CISA Assistant Director positions into career roles.

Among the report's more ambitious recommendations: making tech companies liability for damages from preventable vulnerabilities, requiring vuln handling transparency, regulating data collection, and mandating data breach notification.

The report encourages Congress to create a Commerce Department bureau that would track and publish statistics about cybersecurity incidents, to put some empirical evidence behind future policy decisions.

Other agencies and many companies would be required to submit data to it.

One of the more eyebrow-raising recommendations: creating a government-wide intelligence-sharing platform for cyber threat data.

This will be a nonstarter with the many powerful agencies that already run their own platforms.

The report focuses a lot on critical infrastructure — not only new protections for it, but also new obligations for its operators.

To improve private-sector cybersecurity, the report recommends creating an Energy Star–esque cyber certification and labeling scheme, so companies can attest to following best practices.

It also recommends studying several possible strategies for incentivizing patching.

Several of the report's recommendations are geared toward recovering from true crises: creating a plan for restarting key sectors of the economy, or empowering the government to "rapidly mobilize" security companies like it can with other industries.

The last section of the report deals with military cyber operations. Recommendations include adding joint cyber ops to the Five Eyes arrangement; studying the creation of military cyber reserve; and ensuring the digital security of the nuclear triad.

There is a special focus on the defense industrial base, a top target for U.S. adversaries. The report recommends requiring DIB firms to share threat data with DoD and conduct threat hunting on their networks.

These are just the biggest recommendations in the report, plus a few others that I threw in because they caught my eye. You can read the full report here: drive.google.com/file/d/1ryMCIL…