FEDERAL CYBERSECURITY RESEARCH AND DEVELOPMENT STRATEGIC PLAN (2019) by the Cybersecurity Enhancement Act of 2014 (Public Law 113-274). 5 This law requires the National Science and Technology Council (NSTC) and the Networking and Information Technology Research and Development (NITRD) Program to develop, maintain, and update every four years a cybersecurity R&D strategic plan to guide the overall direction of federally funded R&D in cybersecurity. This Plan was developed by a task group of subject-matter experts from the NSTC and the NITRD Program under the leadership of the White House Office of Science and Technology Policy. The task group also issued a Federal Request for Information through NITRD to provide industry, academia, and the public an opportunity to offer input to this Plan.6 Responses to this Request for Information are posted on the NITRD website. 7 This 2019 Plan carries forward essential concepts and framing from the 2016 Federal Cybersecurity Research and Development Strategic Plan: • Effective cybersecurity requires maturing capabilities founded upon four defensive elements: Deter, Protect, Detect, and Respond (this was previously Adapt; however, Respond is a more comprehensive approach that includes Adapt). • Science and technology (S&T) advances are needed to counter adversaries’ asymmetrical advantages in cyberspace with proactive risk management, through sustainably secure systems development and operation, and via effective and efficient deterrence of malicious cyber activities. • A strong focus is required on evidence-driven S&T for cybersecurity; evidence of efficacy and efficiency is needed to guide cybersecurity R&D and to improve cybersecurity practices. • Advances in the following areas are critical to successful cybersecurity R&D: human aspects, research infrastructure, risk management, scientific foundations, and transition to practice. The following key updates and new priorities are put forth by this 2019 Plan: • People—users who are affected by computing and communication systems—must be included in the realm that needs to be protected by cybersecurity, in addition to systems and data. • Frameworks and methodologies are needed that will enable developers to reason across and manage safety, security, resiliency, and privacy requirements holistically and concurrently. • Efficient adaptation, countering, and recovery capabilities are needed to engender an effective Respond capability. • Focused and coordinated R&D investments are needed in the cybersecurity aspects of these priority areas: artificial intelligence, quantum information science, trustworthy distributed digital infrastructure, privacy, secure hardware and software, and education and workforce development. Cybersecurity R&D is a shared responsibility, with essential roles for government, industry, and academia. Government funds long-term, high-risk research and performs mission-specific R&D. Industry funds near-term research and transitions successful research into commercial products. This document lays out a research agenda for federally funded R&D carried out by government agencies and the U.S. R&D enterprise, informed by interactions with industry and academia. 5 6 7 https://congress.gov/113/plaws/publ274/PLAW-113publ274.pdf https://www.federalregister.gov/documents/2018/11/13/2018-24668/request-for-information-on-update-tothe-2016-federal-cybersecurity-research-and-development https://www.nitrd.gov/nitrdgroups/index.php?title=CSIA-RFI-Responses-2019 –2–