SUPPLEMENTARY INFORMATION:

The national and economic security of the United States depends on the reliable functioning of the Nation's critical infrastructure. The cyber threat to critical infrastructure is growing and represents one of the most serious national security challenges that the United States must confront. On February 12, 2013, the President signed Executive Order 13636, “Improving Critical Infrastructure Cybersecurity.” ^[1] As the President stated in the Executive Order, “repeated cyber intrusions into America's critical infrastructure demonstrate a need for improved cybersecurity.” ^[2]

The Executive Order establishes a policy of enhancing the security and resilience of the Nation's critical infrastructure and maintaining a cyber environment that encourages efficiency, innovation, and economic prosperity while promoting safety, security, business confidentiality, privacy and civil liberties through a partnership with the owners and operators of critical infrastructure ^[3] to improve cybersecurity information sharing and collaboratively develop and implement risk-based standards. The Executive Order sets forth three elements to establish this partnership. First, the Department of Homeland Security (“DHS”) will use a risk-based approach to identify critical infrastructure where a cybersecurity incident could reasonably result in catastrophic regional or national effects on public health or safety, economic security, or national security. Second, the National Institute of Standards and Technology will develop a framework consisting of a set of standards, methodologies, procedures, and processes that align policy, business, and technological approaches to address cyber risks (“the Framework”), which will provide a prioritized, flexible, repeatable, performance-based, and cost-effective approach, including information security measures and controls, to help owners and operators of critical infrastructure indentify, assess, and manage cyber risk. Third, DHS, in coordination with sector-specific agencies, will develop the Critical Infrastructure Cybersecurity Program (“the Program”) to promote voluntary adoption of the Framework.

The Executive Order recognizes that further incentives may be necessary to encourage sufficient private sector participation in the Program. To develop a clearer picture of existing and potential incentives, the Executive Order directs the Department of Commerce to recommend ways to promote participation in the Program.^[4] The recommendations “shall include analysis of the benefits and relative effectiveness of such incentives, and whether the incentives would require legislation or can be provided under existing law and authorities to participants of the Program.” Consistent ( printed page 18955) with the Executive Order, these incentives may include technical and public policy measures that improve cybersecurity without creating barriers to innovation, economic growth, and the free flow of information. The Department of Commerce will submit its recommendations to the President through the Assistant to the President for Homeland Security and Counterterrorism and the Assistant to the President for Economic Affairs no later than June 12, 2013.

Improving cybersecurity practices among entities that do not own or operate critical infrastructure, or for other reasons are unlikely to join the Program, is also an important Executive Branch priority. Therefore, the Department of Commerce also seeks comment on a broader set of incentives that could help to promote the adoption of proven efforts to address cybersecurity vulnerabilities.

The Department of Commerce asked questions related to incentives for noncritical infrastructure in a July 2010 Notice of Inquiry.^[5] Responses to the July 2010 Notice aided the Department's efforts to promote standards and best practices and informed its June 2011 “Green Paper,” Cybersecurity, Innovation and the Internet Economy.^[6] Along with the responses to this Notice, the Department plans to draw again on earlier responses in the development of recommendations to the President on incentives. In addition, the Department plans to use responsive comments to inform a follow-up to the Green Paper.

Stakeholders that responded to the July 2010 Notice may wish to focus on the following questions:

• Have your viewpoints on any questions related to incentives for noncritical infrastructure changed since you filed them in response to the July 2010 Notice?
• Do your comments related to incentives for noncritical infrastructure also apply equally to critical infrastructure?
• Does anything in the Executive Order or recent legislative proposals change your views on what incentives will be necessary or how they can be achieved? In particular, would the incentives that you previously discussed be effective in encouraging all firms that participate in the Internet economy to participate in the Program? Would these incentives encourage critical infrastructure companies to join the Program?

In answering these questions, commenters should not limit their responses to incentives that are feasible under existing law.

For all stakeholders, particularly those that did not respond to these earlier inquiries, the Department of Commerce requests comments on any of the following questions:

• Are existing incentives adequate to address the current risk environment for your sector/company?
• Do particular business sectors or company types lack sufficient incentives to make cybersecurity investments more than others? If so, why?
• How do businesses/your business assess the costs and benefits of enhancing their cybersecurity?
• What are the best ways to encourage businesses to make investments in cybersecurity that are appropriate for the risks that they face?
• How do businesses measure success and the cost-effectiveness of their current cybersecurity programs?
• Are there public policies or private sector initiatives in the United States or other countries that have successfully increased incentives to make security investments or other investments that can be applied to security?
• Are there disincentives or barriers that inhibit cybersecurity investments by firms? Are there specific investment challenges encountered by small businesses and/or multinational companies, respectively? If so, what are the disincentives, barriers or challenges and what should be done to eliminate them?
• Are incentives different for small businesses? If so, how?
• For American businesses that are already subject to cybersecurity requirements, what is the cost of compliance and is it burdensome relative to other costs of doing business?
• What are the merits of providing legal safe-harbors to individuals and commercial entities that participate in the DHS Program? By contrast, what would be the merits or implications of incentives that hold entities accountable for failure to exercise reasonable care that results in a loss due to inadequate security measures?
• What would be the impact of requiring entities to join the DHS Program prior to receiving government financial guarantees or assistance in relevant sectors?
• How can liability structures and insurance, respectively, be used as incentives?
• What other market tools are available to encourage cybersecurity best practices?
• Should efforts be taken to better promote and/or support the adoption of the Framework or specific standards, practices, and guidelines beyond the DHS Program? If so, what efforts would be effective?
• In what way should these standards, practices, and guidelines be promoted to small businesses and multinationals, respectively, and through what mechanisms? How can they be promoted and adapted for multinational companies in various jurisdictions?
• What incentives are there to ensure that best practices and standards, once adopted, are updated in the light of changing threats and new business models?
• Voluntary industry sector governance mechanisms are sometimes used to stimulate organizations to conform to a set of principles, guidelines, and operations based on best practices, standards, and conformity assessment processes that collectively increase the level of assurance while preserving organizations' brand standing and the integrity of products and services.

○ Do organizations participate in voluntary governance mechanisms?

○ Which industries/groups have voluntary governance mechanisms?

○ Do existing voluntary governance mechanisms have cybersecurity-related constraints?

○ What are the benefits and challenges associated with voluntary governance mechanisms?