THE COUNCIL ,
HAVING REGARD to Article 5 b) of the Convention on the Organisation for Economic Co-operation and Development of 14 December 1960;
HAVING REGARD to the Recommendation of the Council on Digital Security Risk Management (Digital Security Recommendation) [ OECD/LEGAL/0479 ]; the Recommendation of the Council on National Digital Security Strategies [ OECD/LEGAL/0480 ]; the Recommendation of the Council on Digital Security of Critical Activities [ OECD/LEGAL/0456 ]; the Recommendation of the Council on the Treatment of Digital Security Vulnerabilities [ OECD/LEGAL/0482 ], the Recommendation of the Council concerning Guidelines for Cryptography Policy [ OECD/LEGAL/0289 ], and the Recommendation on Electronic Authentication [ OECD/LEGAL/0353 ], which form with the present Recommendation a comprehensive set of international standards on digital security featured in the OECD Policy Framework on Digital Security [ C(2022)145/ADD1 ];
HAVING REGARD to the standards developed by the OECD in the area of privacy and transborder flows of personal data, internet and internet policy making, digital economy, innovation, growth and social prosperity, artificial intelligence, public procurement, regulatory governance to harness innovation;
RECALLING that while digital security risk cannot be entirely eliminated, it can be managed and reduced to a level that is acceptable to stakeholders and to society as a whole, and that there is a variety of contexts of use for products and services, levels of risk appetite and digital security maturity as well as available resources amongst stakeholders;
RECALLING that there are often trade-offs between digital security and other elements such as product and service performance, quality, usability and affordability; and that striking the right balance between these elements is crucial to reach an optimal level of digital security;
RECALLING that enhancing the digital security of products and services increases privacy and personal data protection, and that is a key public policy objective to reduce all stakeholders’ exposure to digital security risk, which is increasing due to digital transformation of the economy and society;
RECOGNISING that products and services are increasingly vulnerable to digital security risk, including through vulnerabilities in code and misconfigurations, combined with numerous factors including the increased complexity of technologies and supply chains, as well as capability of threat actors;
RECOGNISING that the likelihood of digital security incidents having negative human safety consequences is increasing with the development of the Internet of Things (IoT) and cyber-physical systems, and that some products and services, upon which critical activities or a very large number of users rely, raise systemic digital security risk;
RECOGNISING that significant information asymmetries, misaligned market incentives, a misperception of digital security risk and economic externalities limit the ability of stakeholders to optimally manage the digital security risk of products and services, and often lead to a lack of investment in digital security;
RECOGNISING that enhanced international co-operation to strengthen the digital security of products and services is essential as their market and supply chains are increasingly global, interconnected and, in some cases, interdependent.
On the proposal of the Committee on Digital Economy Policy:
I. AGREES that the purpose of this Recommendation is to provide policy guidance on how to implement the Digital Security Recommendation to enhance the digital security of products that contain code and can interconnect, and associated services such as cloud and managed services, in order to strengthen trust in the digital transformation, achieve economic and social prosperity, ensure the delivery of critical activities such as healthcare, water treatment, energy distribution and elections, and protect people’s safety;
II. AGREES that, for the purpose of this Recommendation, the following definitions are used:
● Users refers to individuals and organisations that use these products and services. They include corporate and industrial customers as well as consumers.
● Suppliers refers to supply-side actors involved in the product or service’s supply chain, and that have a role in developing, providing access to, maintaining or selling the product or service, such as manufacturers, service providers, providers of components, integrators, intermediaries and vendors, as well as third-party code owners.
● Code owners refers to suppliers responsible for developing and/or maintaining a layer of code. Products may include code from different code owners.
● End-of-support (EOS) , also known as End-of-life, refers to the stage of the product’s lifecycle when suppliers cease to issue security updates. It can be misaligned with the EOU.
● End-of-use (EOU) refers to the stage of the product’s lifecycle when end-users cease to use the product. It can be misaligned with the EOS.
DOMESTIC AND INTERNATIONAL CO-OPERATION
III. RECOMMENDS that Members and non-Members adhering to this Recommendation (hereinafter the “Adherents”) take measures to intensify co-operation on the digital security of products and services, including by:
1. At the domestic level:
a. Integrating policies on the digital security of products and services in their national strategies for digital security and digital transformation.
b. Leveraging the multi-stakeholder digital security community, including suppliers and users, civil society, academia and the technical experts’ community to develop, implement and improve policies in this area, for instance through multi-stakeholder consultations.
c. Establishing a whole-of-government approach to enhance the digital security of products and services, and increasing co-operation between public authorities, in particular those responsible for digital security, consumer protection, intellectual property, consumer product safety, privacy and data protection, insurance, as well as sectoral regulators.
d. Fostering digital security capacity building, including for vulnerable users, organisations with limited resources, such as Small and Medium Enterprises (SMEs), and civil society organisations, as well as organisations supporting critical activities such as in the healthcare sector.
e. Encouraging suppliers and users to collaborate, co-ordinate incident response, and share information on threats, vulnerabilities, and risk related to products and services through CSIRTs, Product Security Incident Response Team (PSIRT) and Information Sharing and Analysis Centers (ISACs).
2. At the international level:
a. Taking into account international technical standards when developing national policies on the digital security of products and services.
b. Sharing good practices on national and regional policies and initiatives to enhance the digital security of products and services.
c. Increasing cross-border co-operation among cybersecurity regulators, sectoral and other relevant regulators, and international standardisation organisations.
d. Encouraging suppliers and users to collaborate, co-ordinate incident response, and share information across borders through CSIRTs, PSIRTs and ISACs.
e. Enabling cross-border interoperability of legal frameworks, including for those establishing digital security requirements for products, services and their suppliers as well as for their certification and labelling.
f. Fostering digital security capacity building in developing countries.
DUTY OF CARE OF SUPPLIERS
IV. RECOMMENDS that Adherents ensure that suppliers take responsibility for the digital security of their products and services (“duty of care”), by designing policies which foster:
1. Security-by-design , whereby suppliers integrate digital security at every stage of the product’s lifecycle, starting from its design (“security development lifecycle”), and in particular:
a. Implement baseline digital security measures, including:
‒ A sufficiently secure update mechanism, access management and authentication mechanisms;
‒ Vulnerability treatment processes, including co-ordinated vulnerability disclosure and patching;
b. Define digital security requirements based on the assessment of the digital security risk their products may pose to their users and third parties, including by:
‒ Developing scenarios of expected use cases and of digital security incidents, based on threat modelling;
‒ Taking into account the:
§ variety of user categories, their use contexts, levels of risk appetite, digital security maturity and available resources;
§ “state of the art” for digital security, including the international technical standards that best fit their risk assessment, known attack methods, as well as technical and economic constraints such as affordability, performance, usability and accessibility;
§ geopolitical context;
c. Ensure that digital security vulnerabilities in their products and services do not pose unreasonable risk to their users and third parties, including with respect to physical safety;
d. Integrate privacy impact assessments and privacy-by-design objectives and requirements in the development process of their products and services;
2. Security-by-default , whereby suppliers take an appropriate level of responsibility for preconfiguring products and services and managing their digital security, rather than shifting this responsibility to users, and in particular:
a. Pre-configure and activate security features by default, while allowing users to opt-out to configure the security features themselves;
b. Provide users with information about preconfigured security settings and clear and simple instructions for security configuration;
c. Provide users with, at least until the product’s EOS and if possible until the product’s EOU, security updates which are:
‒ Free of charge;
‒ Distinct from functional updates or upgrades, where possible;
‒ Automatically activated by default, where possible, in particular for critical vulnerabilities, while enabling users to opt out from automatic updates for example if they need to manage the potential digital security risk that updates can pose in their use context;
d. Provide users opting out from automatic updates with information and warnings about possible risk to themselves and third parties;
3. Dynamic treatment and co-ordination of vulnerabilities , whereby suppliers adopt processes to discover, handle, manage and co-ordinate disclosure and whenever possible directly fix vulnerabilities, as well as communicate clear information to users about security updates, vulnerabilities, exploits, security incidents and possible mitigations, as appropriate;
4. Responsible, clear and transparent end-of-support (EOS) policies , whereby suppliers:
a. Maintain the digital security of their products for a reasonable period, corresponding to the expected length of use of the product;
b. Reduce the gap between the EOS and the EOU, by exploring the following options:
‒ Incentivising end-users to stop using a product when it reaches the EOS, for instance through notifications, discounted or free upgrades, and support for recycling;
‒ Enabling other stakeholders, including users, the open-source community or another organisation, to maintain the product after its EOS, where appropriate and possible, for instance by transferring source code or allowing administrative access for security updates;
c. State publicly the length of time for which their products will receive security updates and the rationale for the duration of the support period;
d. Enable stakeholders to maintain their products in case of unexpected events affecting the products’ EOS, such as the supplier’s bankruptcy, for instance through source code escrow;
e. Monitor, where appropriate, the extent to which their products continue to be used after their EOS and publish relevant data, while respecting user privacy and personal data protection;
f. Protect personal and other sensitive data associated with the product after its EOU or change of ownership (e.g. by enabling destruction of the data);
5. Co-operation across the supply chain’s code owners , whereby suppliers identify and co-operate with other suppliers, code owners, and users including at the technical level, to:
a. Identify all code components and dependency relationships of the product and associated code owners, for both closed and open-source code;
b. Ensure effective vulnerability treatment across the value chain and the various code components of their products;
c. Designate a co-ordinator, where appropriate and feasible, to manage the relationships between code owners. Such co-ordinator may be a supplier such as a PSIRT, a third-party organisation (e.g. a certification or standard body, industry consortium, or specific organisations), a Computer Security Incident Response Team (CSIRT) or a governmental agency;
6. Assessment of the level of digital security of the product and service , whereby suppliers may, depending on the contexts of use and assessment of risk:
a. Self-assess the level of digital security of their products and services regularly against a list of requirements based on international standards;
b. Certify the level of digital security of their products and services through third-party evaluation;
TRANSPARENCY AND INFORMATION SHARING
V. RECOMMENDS that Adherents adopt policies that foster transparency and information sharing with respect to the digital security of products and services, in order to (i) raise awareness and empower users to effectively assess digital security risk related to products and services and make informed decisions on how to use them and (ii) incentivise suppliers to further value and invest in the digital security of their products and services. To that effect, these policies should incentivise suppliers to:
1. Use independent third-party evaluation such as audits, inspection tests, and certification, and to communicate the results of these evaluations, for example through labels;
2. Be transparent to all users and stakeholders regarding:
a. The digital security features of their products and services;
b. The processes and policies in place for addressing the digital security of their products and services (e.g. security-by-design, vulnerability treatment and EOS policy);
c. The risk-profile of their organisation, for instance regarding its digital security risk management strategy, the location of its headquarters and the impact of applicable law (including possible extraterritorial effects) on the digital security of their products and services;
d. Digital security incidents affecting them or actors in their supply chain that could present a risk to their products and services’ users and other stakeholders;
3. Co-operate and share information with public authorities and other stakeholders such as the digital security community and other code owners and suppliers regarding, where appropriate and possible:
a. The traceability for the components of their products (e.g. through a bill of materials) and the lower tiers suppliers that provide these components;
b. The security of their products’ source code, for instance through independent third-party audits, open-source licensing, or transparency centres;
4. Enable advanced users to access and modify security settings of the products they use;
5. Encourage vulnerability researchers, where appropriate, to test a product or service, and to examine “telemetry” data, or metadata about usage and access (log information) to detect anomalies, while respecting personal data protection laws;
VI. RECOMMENDS that Adherents that intend to develop digital security labels for products and services take into account international standards, as appropriate;
FLEXIBLE POLICIES
VII. RECOMMENDS that Adherents adopt policies to enhance digital security of products and services that are proportionate to the risk, and that:
1. Take into account the variety of ecosystems and contexts of use, levels of risk appetite and of digital security maturity as well as stakeholders’ resources;
2. Start with a light-touch approach based on voluntary policy measures, and explore the need for mandatory measures that are principles-based and outcomes-oriented, as appropriate, including to enhance the level of digital security for certain products and services, such as those which could affect safety or critical activities;
3. Support the development of guidance and technical standards for the digital security of products and services;
4. Facilitate the application of consumer protection and liability law to products and services, as appropriate, for example when digital security risk could affect safety;
INNOVATION AND COMPETITION
VIII. RECOMMENDS that Adherents adopt policies to promote innovation as well as research and development to enhance the digital security of products and services, including by:
1. Ensuring that competitive markets enable optimal customer choice and incentivise suppliers to innovate for digital security;
2. Developing research programs and supporting innovation ecosystems focused on digital security;
3. Supporting digital security literacy at all levels of the educational system and in particular by developing specialist programs for digital security in higher education and mainstreaming digital security in non-technical curricula;
4. Enabling controlled experimentation such as regulatory sandboxes to support innovation where existing regulation may limit innovation, while also fostering policy learning and adaptation;
5. Integrating digital security requirements in public procurement;
***
IX. CALLS ON stakeholders, in particular suppliers, to disseminate and follow this Recommendation in their approach to digital security of products and services.
X. INVITES the Secretary-General to disseminate this Recommendation.
XI. INVITES Adherents to disseminate this Recommendation at all levels of government.
XII. INVITES Adherents to the Digital Security Recommendation to take due account of, and adhere to, this Recommendation.
XIII. INSTRUCTS the Committee on Digital Economy Policy, to
a. Serve as a forum for:
i. exchanging information on public policies related to the digital security of products and services in coordination with other international fora, and
ii. developing analytical work to support the implementation of the Recommendation;
b. Report to the Council on the implementation, dissemination, and continued relevance of this Recommendation when reporting on the Digital Security Recommendation.