PPD 41, A Cyber Policy Document

After reading Presidential Policy Directive 41, United States Cyber Incident Coordination, [https://www.whitehouse.gov/the-press-office/2016/07/26/presidential-policy-directive-united-states-cyber-incident ]  I think we have to be grateful that no matter who is elected in November, we will be better off with a new National Security Council.  After 45 years of cyber related work, I have seen a few that got to the coordination of national events, especially those involving the National Command Authority.  There is no evidence anywhere in this publication that anyone looked at what was written about this before, what Cyber Command has produced, or how industry is already involved in coordination of national events effecting an industry.

I mention only two things because these two are indicative of the total lack of thought that went into this document:

1.  They are going to get a senior level group together after the incident has occurred, which is cyber is generally too late.  This is why we have intelligence services and that whole area has been seriously neglected .  It was added as "Oh, yes and we need some intelligence support".  Long before the incident occurs we need lots of intelligence and it better be good enough to allow some response.  

2.  Homeland Security has a big role in putting together a response.  NIST and Homeland are two places that don't actually do anything;  they coordinate.  We have people to do that already and they generally don't pay attention to Homeland.