FEDERAL CYBERSECURITY RESEARCH AND DEVELOPMENT STRATEGIC PLAN (2019) Recommendations for Supporting Activities The Federal Government can support this Plan by carrying out the following recommendations. Prioritize basic and long-term cybersecurity research. The Nation will benefit from a steady increase in Federal cybersecurity R&D, with an emphasis on basic research and long-term, high-risk research initiatives in the Deter, Protect, Detect, and Respond defensive capabilities. Because basic research and long-term research are areas where the private sector is not likely to invest, Federal investments will be important for R&D in these areas. Basic research should emphasize the development of sound scientific foundations and formal, reproducible, and quantifiable methods for assessing the effectiveness and efficiency of cybersecurity solutions. Advance cybersecurity standards. Cybersecurity standards and best practices that address security, privacy, interoperability, and usability are critical tools for reducing vulnerabilities of IT systems to malicious cyber activities. Federal agencies should continue to advance measurement science, standards, and related technologies in ways that underpin and accelerate adoption of effective, efficient, and practical security solutions and technologies. Effective cybersecurity standards will also support U.S. innovation and industrial competitiveness. Accelerate the transition of effective cybersecurity research results into adopted technologies. Federal agencies should streamline the technology transition process for federally funded research and develop a suite of standardized licensing or other intellectual property agreements that could be selected to facilitate technology transfer to commercial entities as well as to the Federal Government. Within its acquisition process, Federal agencies should support solutions and technologies that advance the capabilities described in this Plan. Agencies should align such efforts with the Lab-toMarket Cross-Agency Priority Goal in the President's Management Agenda.33 Federal agencies can also lower the barriers to entry into the cybersecurity R&D marketplace by funding common research infrastructure (e.g., testbeds and datasets) to lower the cost of entry for small businesses, startup companies, and academic institutions, and to increase overall participation in R&D. Expand diversity of expertise and diversity of workforce in cybersecurity. Cybersecurity is more than technology. To accelerate progress, traditional cybersecurity research should be augmented with expertise from social, behavioral, and economic disciplines. Multidisciplinary research should be promoted by funding agencies and by research institutions. Agencies should ensure that grant solicitations encourage multidisciplinary proposals. Research institutions should ensure that personnel advancement (e.g., tenure) decisions value multidisciplinary research successes and publications as highly as traditional tenure criteria. Diversity encompasses race, gender, ethnic group, age, personality, cognitive style, education, background, and more. Harnessing the talents of a workforce that includes people of all backgrounds who are diverse in thought, experience, and skills is essential to enabling innovation and creative discovery. Organizational leaders should take measures to foster an inclusive workplace climate in cybersecurity to attract and recruit new talent and maximize workforce engagement. Federal agencies should work with cybersecurity stakeholders to promote the visibility of cybersecurity careers and increase the mobility of cybersecurity professionals across government, industry, and academia. 33 https://www.performance.gov/CAP/lab-to-market/ – 29 –