FEDERAL CYBERSECURITY RESEARCH AND DEVELOPMENT STRATEGIC PLAN (2019) Effective and efficient organizational risk management: Organizations need an understanding of the range of vulnerabilities and threats in cyberspace and how it applies to them. This involves evidence-based risk management, which is the process of identifying, assessing, and responding to risk, including the development of effective and measurable controls. Organizations must have access to evidence of the efficacy and efficiency of these controls as well as be prepared to consider the human aspects with respect to users, developers, operators, defenders, and adversaries. Effective and efficient deterrence and countering of malicious cyber activities: Techniques are needed that can discourage malicious cyber activities by increasing costs and risks and lowering gains for adversaries. Active forms of deterrence that utilize appropriate countermeasures to reduce the operational effectiveness of malicious cyber activities are also needed—that is, actions or techniques that reduce threats, eliminate or prevent attacks, or minimize the harm they can cause. Integrated safety-security-privacy framework: Many operational systems being developed today (e.g., autonomous vehicles) require that safety, security, resiliency, and privacy requirements be managed concurrently. However, frameworks do not yet exist that allow holistic integration of such requirements. Frameworks and methodologies are needed that will enable designers and developers to reason across all domains concurrently. Sustainably secure systems: There is an acute need for design and implementation of software, firmware, and hardware that are highly resistant to malicious cyber activities, along with development of effective, measurable technical and nontechnical security controls that consider human behavior as well as the economic drivers associated with cyberspace. Approach This Plan provides a framework of four interrelated defensive elements to realize cybersecurity goals; they are defined as follows: Deter: The ability to discourage malicious cyber activities by increasing the costs to, diminishing the spoils of, and increasing the risks and uncertainty for potential adversaries. Protect: The ability of components, systems, users, and critical infrastructure to efficiently resist malicious cyber activities, and to ensure confidentiality, integrity, availability, and accountability. Detect: The ability to efficiently detect, and even anticipate, adversary decisions and activities, given that perfect security is not possible and that systems should be assumed to be vulnerable to malicious cyber activities. Respond: The ability of defenders, defenses, and infrastructure to dynamically react to malicious cyber activities by efficiently adapting to disruption, countering the malicious activities, recovering from damage, maintaining operations while completing restoration, and adjusting to thwart similar future activities. These four elements are similar but not identical to the five core functions in the National Institute of Standards and Technology’s (NIST) Framework for Improving Critical Infrastructure Cybersecurity.8 Whereas the five NIST core functions (Identify, Protect, Detect, Respond, Recover) are geared toward operational cybersecurity risk management, this Plan is intended to guide cybersecurity R&D. The main 8 https://doi.org/10.6028/NIST.CSWP.04162018 –4–