The Biden Administration faces a daunting list of cyber problems, ranging from espionage to intellectual property theft to ransomware. To its credit, the Administration has prioritized tackling these threats and is developing a suite of policy proposals to address them. The proposals will undoubtedly require new resources and the realignment of existing resources. However, the Administration mustfirst resolve a key organizational question: how should it structure the position and office of the National Cyber Director (NCD)?
Congress recently created the NCDand its office, and it will expect the Administration to fill this position before it approves new resources or authorities.As one of its first actions, the Administration created a Deputy National Security Advisor (DNSA) for Cybersecurity on the National Security Council (NSC) staff, at least in part to address immediate cyber crises. As a result, the US has gone from no government-wide cyber leadership to two senior positions in a matter of months. Having two government-wide positions focused on cybersecurity creates both an opportunity and a risk. The opportunity is that the combination of positions could provide a powerful force for getting the resources needed and driving the organizational change required to implement the proposed policies. The risk is that the positions will compete bureaucratically, essentially undermining each other.
Thus, allocating responsibilities between the NCD and the Cybersecurity DNSA becomes a key organizational decision. Although a complete separation of duties is impossible, a reasonable division is feasible. For example, the NCD could focus on long-term, strategic policy – organizing, training, and equipping US government agencies to be successful at their cybersecurity missions. The office of the NCD could take a more public-facing role, leading efforts to develop legislation, collaborating with the private sector, and reducingbarriers that impede effective cybersecurity. The DNSA could focus on short-term operational activities that are part of counter-adversary campaigns or responses to immediate cyber crises. Each office would need insight into the other’s activities, and a high degree of coordination would be necessary, but this kind of division could work. If it wants to improve the nation’s cybersecurity capabilities, the Administration needs to get this key organizational decision right.
Michael Daniel formerly served as the White House Cybersecurity Coordinator and is currently serving as President & CEO of the Cyber Threat Alliance.