Opinion: Cybersecurity is a test of management before it becomes a national emergency
OPINION — America often talks about cybersecurity as if it begins with an adversary overseas and ends with a warning from Washington. Too much of the work in between belongs to people who would rather call it someone else’s problem.
Federal agencies’ October warning about SafePay ransomware is a timely reminder to ask who is responsible before an organization loses access to its systems. A threat bulletin is useful only if somebody has authority to turn its warning into action.
The National Institute of Standards and Technology puts that responsibility in plain view. Its Cybersecurity Framework 2.0 includes governance alongside identifying, protecting, detecting, responding and recovering. Leadership is part of security, not an administrative distraction from it.
Ask questions before buying reassurance
A board or public official does not need to understand every technical detail to ask useful questions. Which services cannot operate without these systems? Who can approve emergency decisions? When was recovery last tested? Which outside suppliers hold access?
Answers should be concrete enough to survive a follow-up question. Saying that the organization uses a reputable vendor is not the same as explaining what happens if the vendor is unavailable or compromised.
The same principle applies to public purchasing. A contract can transfer a task without transferring every consequence of failure. Officials remain responsible for understanding which functions the public would lose and how essential work would continue.
That is not a demand for impossible guarantees. It is a demand that the people accepting a risk know what they are accepting.
Treat recovery as a capability
Organizations love the language of resilience. They should be asked to demonstrate it. A plan that has never been practiced may be a useful draft, but it is not proof that recovery will work under pressure.
A meaningful exercise should reveal decisions that become difficult when systems are unavailable. How will staff communicate? Which records are needed first? How will leaders explain what is known without presenting assumptions as facts?
Those questions are managerial as well as technical. They require priorities, responsibility and a willingness to expose weaknesses before a criminal does.
The conservative instinct toward accountability fits this problem well. Taxpayers and customers should not be asked to accept expensive assurances without a clear account of what those assurances mean.
Keep Washington’s role focused
The federal government can share intelligence, investigate criminals and support organizations that lack specialized resources. It should make those services understandable and useful.
But a new federal initiative does not eliminate a local organization’s obligation to maintain its own systems. Nor should the seriousness of a threat become a standing excuse for collecting more money without measuring results.
Security policy needs both levels of responsibility: public action against threats that exceed an individual organization’s reach, and competent management of risks within that organization’s control.
Blurring the distinction makes failure easier to explain away. Every local breakdown becomes a national problem, while every national announcement is treated as evidence that local defenses have improved.
The more useful standard is modest and demanding. Identify who owns the risk. Give that person the authority to act. Test the plan. Report what still does not work.
National resilience is built from those decisions. The dramatic warning may come from Washington, but the quieter test of leadership usually arrives much earlier, in a meeting where somebody must decide whether a known weakness will finally be fixed.
