FEDERAL CYBERSECURITY RESEARCH AND DEVELOPMENT STRATEGIC PLAN (2019) Research organizations and professional societies are natural partners in cybersecurity R&D efforts. They produce research strategies, organize conferences, and publish journals. By establishing publication requirements for documented efficacy and efficiency, these organizations can greatly aid and improve scientific rigor in the cybersecurity field. Commercial Sector Budgets for commercially funded cybersecurity research are usually comparatively modest for even the largest IT companies. Private-sector R&D funding is typically internal and focused on productdevelopment goals based on the specific needs of the company as well as on profitability and turnaround time. While companies often have the skills to perform long-term and high-risk research, the opportunity cost of their moving personnel to address these topics is high, even when government funding is available to defray the immediate costs, because longer-term research often benefits the entire industry, not just the company that funded it. Nonetheless, there are opportunities for the R&D activities of the private and public sectors to be synergistic and complementary. A well-functioning cybersecurity research ecosystem must offer several mechanisms for the two sectors to mutually benefit each other. Coordination and Collaboration Coordination and collaboration across sectors are essential to avoiding redundant research initiatives. The Federal cybersecurity R&D community engages with industry via many public-private partnerships. For example, partnerships exist in the area of the trusted computing base that provides technology for hardware-based cryptography, key repositories, self-encrypting drives, and device authentication. Agencies use advisory boards to obtain industry perspectives, such as the NIST Information Security and Privacy Advisory Board.31 Both the Department of Homeland Security and the Department of Defense have offices in Silicon Valley to expand their conversations with technology innovators. In addition, the National Cybersecurity Center of Excellence, an example of a Federal, state, and local government partnership (NIST, the State of Maryland, and Montgomery County, MD), focuses on accelerating the adoption of secure technologies.32 Opportunity for fruitful collaboration exists in expanding efforts to measure and verify efficacy and efficiency in cybersecurity products and services. Consumers and enterprises need such information for effective and efficient management of their cybersecurity risks. Private-sector product vendors should consider the full range of costs of using cybersecurity solutions, including financial costs, cognitive load on users, and innovation-inhibiting practices. Another fruitful partnership opportunity for commercial entities would be to jointly identify precompetitive research areas in which privatepublic partnership funding would be most productive. Coordination between Federal departments and agencies is facilitated by the NSTC. Unclassified Federal R&D efforts in networking and information technology are coordinated by the NITRD Program and its National Coordination Office. Classified research efforts are coordinated by the NSTC Special Cyber Operations and Research and Engineering Subcommittee. Federal Cybersecurity R&D Strategic Plan Implementation Roadmap The coordinated R&D activities of this Plan are carried out by Federal agencies with varying missions but complementary roles. This arrangement assures that the full spectrum of R&D approaches is 31 32 https://csrc.nist.gov/projects/ispab https://www.nccoe.nist.gov/ – 27 –