AUSTRALIA–US CYBER COOPERATION: NEXT STEPS The dialogue discussions on bilateral cooperation to combat cybercrime and support digital trade in the region are invaluable but, ultimately, actions speak louder than words. That’s why it’s important to translate the dialogue’s productive conversations into an action plan that addresses short-, medium- and long-term issues. ASPI and CSIS have identified three joint projects to be pursued in the lead-up to the 2017 dialogue. This joint forward work plan will facilitate improved bilateral public–private cooperation on cybersecurity issues, increase the strength of Asia– Pacific cybersecurity, and identify ways to reduce the barriers to deeper business engagement. First, effectively coordinating capacity-building efforts in the Asia–Pacific will strengthen the scope and reach of bilateral efforts and better engage private sector skills and capacity. Capacity building is the key to enhancing the region’s security, facilitating new business opportunities and shaping the region’s perspectives on key international cyber policy issues. ASPI’s annual report, Cyber maturity in the Asia–Pacific region, has consistently identified countries in the Southwest Pacific and Southeast Asia as having a weak political and legal approach to cybersecurity and a severe lack of cyber incident response capability. As discussed, both Australia and the US have significant strategic, law enforcement and economic interests in improving the cybersecurity capacity of Asia– Pacific countries, particularly among ASEAN countries. Additionally, the private sectors in both countries also have an interest in improving Asia–Pacific cybersecurity. Stable online environments and trust in digital transactions are crucial for expanding business opportunities in this economically thriving region. Funding for capacity building is obviously finite, so it’s important to ensure that projects are as efficient as possible. Consultation with government and the private sector in Australia and the US will help projects to be devised in a manner that reduces the duplication of effort, pools resources and ensures that projects work towards the achievement of mutual strategic goals. ASPI and CSIS will work with dialogue partners to identify priority areas of focus for cybersecurity capacity-building, either geographical or thematic. Through this consultation and associated research, the cybersecurity capacity-building projects of dialogue stakeholders will be made as efficient as possible, and will better engage private-sector skills and capacity in the process. Increasing communication and transparency among capable governments and companies may help to establish novel partnerships that will benefit the region. Second, a bilateral public–private cybersecurity incident response exercise would elevate cross-sectoral cooperation and improve cyber resilience in both countries. Exercises that test national responses to cybersecurity incidents are valuable ways to evaluate cyber incident and crisis response capacity. Such simulations challenge the ability of states and organisations to identify the issue, contain the effects and recover from the consequences as quickly and efficiently as possible. They are useful tools for revealing the strengths of current policy frameworks and highlighting areas of weakness that need addressing. Importantly, it’s not only governments that must prepare for such incidents. Private-sector organisations, as the heartbeat of national economies, are also significant targets and accordingly must prepare themselves by improving their resilience through such exercises. ASPI and CSIS will connect interested private sector and government dialogue partners and offer consultative support to the design of an exercise that’s relevant and realistic and meets corporate, agency and national-level exercise goals. Best practice and big mistakes identified during the simulation will help to inform subsequent dialogues and highlight areas for further cooperation and incident response improvement.