An industry source in the telecommunications sector told Inside Cybersecurity that the directive offers enough clarity to be useful by industry and builds on existing efforts. “I’m glad they’re not creating something new,” the source said. “There’s some foundation to build on.” Chris Feeny, president of the Financial Services Roundtable’s Cyber and Technology Policy Division, added in a statement that the document is “critical” in protecting consumers from malicious cyber actors. “Ensuring the private sector and the government clearly understand roles and responsibilities in advance of a cyber incident is critical in ensuring consumers are protected,” Feeny said.
Brian Finch, a partner at Pillsbury Winthrop Shaw Pittman with experience in cyber issues, told Inside Cybersecurity that the directive excels at clearing up confusion in incident response and distinguishing between cyber incidents and more-serious “significant” cyber incidents. However, Finch said the directive’s definition of “significant” breaches “underestimates the scale and scope of cyber threats.” “It’s truly disturbing to see how easy and cheap it is to acquire sophisticated malware as well as hire cyber mercenaries,” Finch said. “So I think the [U.S. government] needs to reconsider the point about significant incidents typically being reserved for nation-state actors.” Finch added that a more explicit role for the Secret Service should have been included as well, stressing that they have “incredible capabilities” and “while they are implicitly referred to by virtue of being part of DHS, their skill set and experience demands to be recognized in this document.”
Jamie Brown, director of global government relations at CA Technologies, said the directive should have a “marginally helpful” impact on efforts to improve cybersecurity by eliminating confusion about roles and responsibilities, but full implementation of new programs like Continuous Diagnostics and Mitigation and Automated Indicator Sharing are needed to fully address the changing cyber threat landscape.