Revamping Cyber Defense: Solarium Commission’s Lasting Impact Five Years Later

Revamping Cyber Defense: Solarium Commission’s Lasting Impact Five Years Later

Five years after its first report, the Cyberspace Solarium Commission (CSC) still shapes U.S. cyber policy. This article looks at which recommendations took hold, what remains undone and how the Commission changed U.S. cybersecurity strategy.

At a glance

• Strategy: CSC’s recommendations reshaped U.S. cybersecurity policy and frameworks.
• Public-private cooperation: The Commission pushed for closer work between government agencies and private companies.
• Laws and policies: Several laws and executive actions grew out of CSC’s recommendations.
• Unfinished work: Bureaucratic resistance and fast-changing threats still slow progress.

Where the Commission came from

In 2018, Congress created the Cyberspace Solarium Commission to work out how to defend the U.S. against growing cyber threats. Its name comes from President Eisenhower’s 1953 Project Solarium. The goal was a national strategy that would get ahead of digital threats instead of reacting to them. Five years later, its recommendations are visible across U.S. cyber policy.

A new national strategy

The Commission wanted to change how the U.S. defends itself in cyberspace. It called for faster responses to cyber threats and for policies that would let the U.S. take the initiative instead of waiting to be hit.

Mark Montgomery, the Commission’s executive director, has argued that it shifted strategy toward resilience and what it called layered deterrence. Many of those ideas were written into the National Defense Authorization Act and other key cyber laws.

Working with industry

A central recommendation was a stronger partnership between government and the private sector. The Commission wanted ongoing dialogue and cooperation to improve defenses for critical infrastructure.

Industry leaders agree, since private companies own and run most critical infrastructure. Chris Inglis, the former National Cyber Director and a Commission member, has repeatedly argued that government and industry have to defend networks together. Closer cooperation has improved threat intelligence sharing and joint exercises.

Laws that came out of it

The Commission’s influence reached Congress. Laws shaped by its recommendations include the creation of the Office of the National Cyber Director and stronger cyber provisions in the National Defense Authorization Act.

Regular risk assessments and strategy updates are now required, so policy can change as threats change.

What is still unfinished

Progress has been real, but problems remain. Threats change fast. Coordination across agencies and with allies is hard. Bureaucratic inertia still slows the government’s response.

Experts also point to the need to build skills in emerging technologies such as AI and machine learning, which are now common in cyber operations. That area still needs more investment and attention.

What Congress still needs to do

Five years on, the Solarium Commission has pushed U.S. cyber policy toward resilience and cooperation. New threats keep coming, though, and several recommendations remain unfinished.

Watch three things: whether Congress keeps funding CISA and the National Cyber Director’s office, whether rules for critical infrastructure security get finished, and whether the government builds the cyber workforce the Commission called for.

Dan Evert, CCNP

Dan Evert is a self proclaimed Router Jockey. Dan got heavily involved in networking right out of high school and has never looked back! Dan is giving back by working with high school students to get them involved and interested in Networking and Security.