How the administration’s cyber strategy falls short

In response to the White House’s newly released National Cybersecurity Strategy (NCS) Implementation Plan, one cannot help but voice concerns over its alarming lack of clarity and specificity. Unfortunately, it reflects an ongoing pattern within this administration, a puzzling avoidance of detail, and a seeming underestimation of such specificity’s role in successful strategy execution.

The NCS Implementation Plan is a strategic blueprint, yet it is vague, creating a dissonance between intention and operation. The administration has underestimated the complexity of the cyber realm; their plan echoes this by offering a set of initiatives and completion dates but still needs to provide a clear roadmap to achievement.

Vague rhetoric isn’t enough in the face of looming technological and geopolitical challenges. While the plan sets forth a vision, it fails to provide actionable tactics, clear benchmarks, and measurable indicators to monitor progress and ensure accountability. These omissions risk leaving the nation in a state of perpetual planning rather than moving it toward robust cyber resilience.

Moreover, the administration’s oversight of time’s crucial role in the rapidly evolving cyber domain is concerning. The cybersecurity landscape is fast-paced, and its threats are unpredictable and constantly evolving. A reactive, slow-paced response strategy can be perilous in such a scenario.

Therefore, the United States needs to act with greater specificity and a sense of urgency. The NCS Implementation Plan needs more than a list of lofty objectives and ideal completion dates; it requires a granular action plan that enables us to respond rapidly and effectively to emerging threats.

While the release of the NCS Implementation Plan signifies a step in the right direction, it falls woefully short of what is required. The future of our national security, economic stability, and technological leadership hinges on our ability to navigate the cyber domain effectively. Therefore, this administration must rise to the challenge, shedding its naivety, embracing detail, and acting swiftly to bolster our national cyber posture.

While noble in its intentions, the Implementation Plan could benefit from increased precision and clarity. Here are a few actions that might enhance its effectiveness, ensuring that both the public and private industry understand their role and the broader impact of the plan.

1. Define clear goals and objectives: The plan should lay out the specific goals it aims to achieve and the objectives that will help it get there. These should be SMART (Specific, Measurable, Achievable, Relevant, and Time-Bound) to give stakeholders a clear, tangible target.

2. Outline a precise roadmap: Rather than a list of lofty objectives, the plan should include a step-by-step guide detailing how each goal will be achieved, the resources required, and potential hurdles that could be encountered along the way.

3. Detail resources and assign responsibilities: The plan should clarify the resources — budgetary allocations, personnel, technological infrastructure, and the like — needed to implement the strategy. Additionally, responsibilities for various tasks should be clearly delineated, emphasizing the roles of public and private stakeholders.

4. Establish public-private partnerships: It is important for the plan to define the roles and responsibilities of both public agencies and private entities. Encouraging public-private partnerships can foster shared responsibility, increase resource availability, and improve overall cyber resilience.

5. Set specific milestones and key performance indicators (KPIs): The plan must include key milestones and KPIs to help monitor progress and measure success. These should be tied to specific dates to promote urgency and motivate stakeholders.

6. Develop a rapid response protocol: Given the fast-paced nature of the cybersecurity landscape, the plan needs a well-defined rapid response mechanism to address threats as they emerge. This protocol should also be adaptable, accounting for cyber threats’ unpredictable and evolving nature.

7. Promote transparency and accountability: Regular progress reports and audits should be mandated to ensure transparency, accountability and to encourage continuous improvement of the plan and its execution.

8. Continuous learning and adaptation: With the cyber landscape constantly changing, the strategy should incorporate a mechanism for regular reviews and updates based on new knowledge, technologies, and threat profiles.

With these additions and revisions, the NCS Implementation Plan can become a more powerful and practical tool for safeguarding the nation’s cybersecurity. As we traverse this digital era, an effective, transparent and adaptable cybersecurity strategy is desirable and an absolute necessity.

Jeffrey Wells is a former Maryland cyber czar and founding partner of NIST’s National Cybersecurity Center of Excellence. Currently he is partner at risk services company Sigma7.