Group of CISOs calls on OECD, G7 for stronger alignment of security regs – Source: www.csoonline.com

Unless countries align their cybersecurity strategies, fragmentation will compromise cyber defenses and response, a group of more than 40 chief information security officers (CISOs) from global enterprises warned world leaders in an open letter Wednesday.

The coalition called for action from the G7 and the Organization for Economic Co-operation and Development (OECD), urging them to prioritize greater alignment of regulations to, it said, “maximize the effective use of limited resources.”

The group, which includes executives from big name enterprises and organizations such as Salesforce, Microsoft, AWS, Mastercard, SAP, and Siemens, is asking the OECD and G7 to adopt international standards, ink reciprocity agreements, share threat intelligence, and collaborate with the private sector.

“Malicious cyber threat actors continue to target our companies, governments, and societies, often with impunity,” the letter stated. “The interconnected nature of the cyber landscape necessitates collaboration across borders.”

Make a ‘political commitment’ to cybersecurity

The CISOs noted that there has been a recent proliferation of cybersecurity laws and regulations around the globe, but international cooperation and coordination on cybersecurity is “nascent.”

Growing divergence and fragmentation in global regulations is making cyber defense more difficult, they said, and inconsistent or conflicting regulations increase the complexity of time-sensitive incident response and reporting.

The coalition is calling on the G7 and OECD to:

• Make a commitment to better align cybersecurity regulations in relevant forums, namely the upcoming G7 and OECD meetings. International leaders should focus on consistently aligning existing regulations; commit to collaborating on future regulations; balance the timing for implementation versus new regulation; enable quicker exchange of threat intelligence; and agree to consult with the private sector.

• Agree to use the OECD’s expertise and forum “to implement this political commitment” and to convene regulators across countries and sectors on a regular basis, ideally once or twice a year in a multi-stakeholder gathering, with private sector participation as well as industry and other non-governmental representatives. The group should develop an action plan and provide regular progress updates to decision-makers and authorities.

Further, the coalition urged international leaders to form reciprocity agreements, adopt international standards, and make third-party assessments and audits applicable across borders.

“This approach would result in a cohesive and harmonized regulatory environment that would facilitate better cooperation and information sharing among nations and enhance our collective defense against cyber threats,” the coalition wrote.

Current situation ‘untenable’

The letter is well-timed to be considered at the 2025 G7 summit being held in Alberta, Canada, in June, and experts point out that the presence of the G7 and OECD member states provide a unique opportunity for CISOs to address a centralized body with the political means and might to influence regulators and achieve global cybersecurity consistency.

“There is a need for some level of cybersecurity regulation harmonization, especially for the benefit of organizations that operate on a multi-national basis,” said Will Townsend, VP and principal analyst at Moor Insights & Strategy.

Indeed, countries all over the map are … all over the map. Canada, for one, is “woefully, massively, behind the United States,” said David Shipley of Beauceron Security.

That’s not for lack of trying. Shipley serves as co-chair for the Canadian Chamber of Commerce’s cyber council, which has been pushing for nationwide cybersecurity regulations. While legislation has failed to pass so far, the goal is to become “closely harmonized” with the US’s existing regulations, notably because critical infrastructure crosses the countries’ borders.

Different definitions and reporting timeframes “just add layers of confusion and complexity to the incident response process,” said Shipley.

And that’s just between two countries; things get exponentially more complex and confusing as more jurisdictions become involved, he noted.

“Each country running in their own direction, doing their own thing without alignment, is untenable,” said Shipley. “The reality is that criminal groups cooperate far better than the good guys, certainly better than the good guys in government. We’ve got to get better at this.”

Diverse privacy regs add complexity

International collaboration among governments, regulatory bodies, and the private sector is essential to combat cyber threats effectively, noted Fritz Jean-Louis, principal cybersecurity advisor at Info-Tech Research Group.

“CISOs of global organizations operating in multiple jurisdictions must pay attention to the potential implications for enterprises due to the ever-increasing complexity of regulatory requirements related to security,” he said.

This is particularly critical in the area of privacy, where “complex and at times divergent” regulations create an environment that is complex to manage, difficult to achieve compliance in, and expensive to implement and maintain, said Jean-Louis, “while not necessarily improving security capabilities to effectively address threat actors.”

“Cybersecurity regulations are not always the best way to engage and mitigate this risk,” he added, pointing out that there are “few direct correlations” between regulatory pressure and the effectiveness of cybersecurity controls. Instead, CISOs sometimes have to divert important assets and resources to address compliance requirements that are not necessarily improving security posture.