Advantages of soft policies --- Let me challenge this view that only the 'hard policies' (regulations and laws) play the role in cyberspace - and offer examples why soft policies mater maybe even more. We have already discussed the critical role of other stakeholders - primarily the private sector which operates much of the digital services and infrastructure. Without their sincere participation (and other stakeholders), there is no secure country. How can we get them on board?

Too strict regulation plays against the interests of many companies, as this requires investments in compliance, and ties their hands when it comes to innovation, fast roll-out of new services, etc. Ultimately, they will certainly satisfy the hard requirements, but will this actually help? Will we be able to implement hard policies meaningfully?

Let me give you an example. A binding obligation for all the companies to report about incidents to the CERT, for instance, will make them always fill the form. But, they won't do more than that. Reality of incident response is continuous information exchange and support by parties based on trust; there is no trust if you force another party into this relation. It is similar with the certification schemes and compliance - most big companies comply with all the variety of ISO and other standards and requirements; yet, as we see from SolarWinds this isn't sufficient even for the big companies - instead, they need to understand and get prepared to cooperate. You may think of many other examples. Global character of cyber-risks, and the cross-jurisdictions problem - adds to complexity.

Instead, a trust-built CERT - in which partners learn what benefits they get from CERT (e.g. international, network and information) in return for sharing own findings with them - works. Public-private partnerships to increase capacities of the business sector to understand the risks and measures that help is more likely to boost up resilience of the state (including the CI) than only mandating requirements and compliance. Think of other soft policies that can help awareness and education, standards implementation, information sharing, etc.

Regulations and laws, of course, remain important and necessary, especially for some critical elements. They should set the base of responsibilities, and repercussions. But soft policies and incentives are very much needed to really put 'all hands on the deck' and strengthen all the weak links we have around.

Inviting your comments on this!

Source author: Vladimir Radunovic vladar@diplomacy.edu