THE COUNCIL ,
HAVING REGARD to Article 5 b) of the Convention on the Organisation for Economic Co-operation and Development of 14 December 1960;
HAVING REGARD to the Recommendation of the Council concerning Guidelines Governing the Protection of Privacy and Transborder Flows of Personal Data [ OECD/LEGAL/0188 ]; the Recommendation of the Council on Principles for Internet Policy Making [ OECD/LEGAL/0387 ]; the Recommendation of the Council on the Governance of Critical Risks [ OECD/LEGAL/0405 ]; the Recommendation of the Council on Digital Security Risk Management for Economic and Social Prosperity [ OECD/LEGAL/0415 ] (Digital Security Risk Recommendation) and the Declaration on the Digital Economy: Innovation, Growth and Social Prosperity (Cancún Declaration) [ OECD/LEGAL/0426 ];
HAVING REGARD to the experience and best practices that emerged from the implementation of the Recommendation of the Council on the Protection of Critical Information Infrastructures [ OECD/LEGAL/0361 ], which this Recommendation replaces;
RECOGNISING that
● Digital transformation affects all economic and social activities, spurring innovation and generating significant benefits, but also exposes these activities to increasing digital security risk;
● Digital security risk results from potential intentional or unintentional threats that are cross-border in nature, exploit vulnerabilities and produce incidents affecting the availability, integrity and confidentiality of the data, hardware, software and networks on which these activities rely;
RECOGNISING that the multiplicity and complexity of digital dependencies across sectors and borders and along critical activities' value chains create a shared digital security risk that no single actor can significantly reduce for all; that each actor is therefore dependent upon and responsible towards all others to manage digital security risk;
RECOGNISING that partnerships within and across the public and private sectors are essential to approach digital security risk to critical activities in a coherent and holistic manner;
RECOGNISING that the Digital Security Risk Recommendation provides a robust framework to strengthen digital security of economic and social activities without reducing the opportunities offered by digital transformation;
RECOGNISING that critical activities run by different operators in different sectors and countries depend on the same digital technologies and therefore can be simultaneously disrupted by threats exploiting common vulnerabilities; that digital security incidents can propagate extremely quickly across operators, sectors and borders; and that disruptions in the delivery of critical activities caused by digital security incidents in one place can cascade onto other operators, sectors and countries, potentially affecting regions and international stability;
RECOGNISING that the consequences of digital security incidents affecting critical activities run by public and private operators may extend beyond the interests of these operators, affect a whole society and others beyond borders; and that, as a consequence, any residual risk taken by these operators may affect all those who depend on such activities as well as society as a whole;
RECOGNISING that enhancing the digital security of critical activities is a priority for national policy; that discrepancies in public policies across countries increase the complexity of managing the digital security of interdependent critical activities across borders; and that international co-operation is therefore essential to reduce such discrepancies and maximise the global effectiveness of domestic policies;
MINDFUL that the management of digital security risk to critical activities has to respect privacy and personal data protection;
MINDFUL of the variety of cultures, as well as legal and institutional frameworks in Members and non-Members adhering to this Recommendation (hereinafter the “Adherents”) and of the possible use of different terminology in Adherents’ policies to enhance digital security of critical activities;
On the proposal of the Committee for Digital Economy Policy:
I. AGREES that the purpose of this Recommendation is to provide guidance on how to implement the Digital Security Risk Recommendation to maintain the continuity, resilience and safety of critical activities without inhibiting the benefits from digital transformation.
II. AGREES that, for the purpose of this Recommendation:
● Critical activities refer to economic and social activities the interruption or disruption of which would have serious consequences on:
‒ the health, safety, and security of citizens;
‒ the effective functioning of services essential to the economy and society, and of the government; or
‒ economic and social prosperity more broadly.
Critical activities are identified on the basis of a national risk assessment.
● Operators are the public and private entities that carry out critical activities.
● Critical functions refer to the processes without which operators could not effectively carry out their critical activities.
● Digital ecosystem refer to the digital environment that supports an operator’s critical functions along the value chain of critical activities. It includes digital assets such as hardware, software, networks and data, operational technologies that detect or cause changes in physical processes, as well as the internal and external entities, persons and processes that design, maintain and operate them, and the relationships between them.
OVERARCHING POLICY FRAMEWORK
III. RECOMMENDS that Adherents develop a strategic approach to the management of digital security risk to critical activities by:
1. Adopting at the highest level of government, and as part of a national digital security strategy, clear objectives to strengthen digital security and resilience of critical activities, and ensure consistency with national risk assessment and other risk and sector-specific strategies.
2. Adopting and publicly releasing a domestic governance mechanism that allocates authority and responsibility to specific government bodies for developing and implementing with relevant stakeholders policies to enhance digital security of critical activities within and across sectors. The domestic governance mechanism should also identify, where appropriate, any supporting role played by government bodies in charge of national security and defence.
3. Ensuring a whole-of-government domestic co-ordination in order to:
a. Establish intra-governmental co-operation, taking full account of the importance of a dialogue between digital security and sectoral experts;
b. Ensure consistency of the measures adopted across sectors, where appropriate, and resolve potentially competing policy objectives;
c. Allocate resources effectively across responsible government bodies and create a critical mass of expertise and skills; and
d. Facilitate cross-border co-operation.
IV. RECOMMENDS that Adherents build capacity to support digital security risk management and resilience of critical activities by:
1. Developing a new or strengthening their existing incident response capability , such as through one or more Computer Emergency Response Teams (CERT), Computer Security Incident Response Teams (CSIRT) and/or Security Operation Centres (SOC), in charge of monitoring, warning, alerting and carrying out recovery measures, as well as mechanisms to foster closer co-operation and communications among those involved in incident response;
2. Facilitating co-operation among CERTs/CSIRTs/SOCs and operators , including incident reporting and analysis, to promote swift and effective operational cooperation;
3. Applying best practice for digital security risk management related to the provision of critical digital activities by the government .
4. Promoting international digital security standards , methodologies, baseline security manuals, best practice and tools;
5. Providing support to operators , as appropriate, including by:
a. sharing information on threats, vulnerabilities, and risk management practice,
b. supporting operators in assessing risk and establishing appropriate risk treatment measures,
c. providing assistance and/or guidance in case of incident or crisis; and
d. providing toolkits, methodologies, best practice and tools;
6. Fostering the development of the global market for a variety of trusted security services and products, including managed services, audit and response services, including where appropriate through a range of mechanisms for credible signalling of the nature and degree of security;
7. Supporting the development of a skilled workforce that can manage cross-sector and sector-specific digital security risk;
8. Adopting and encouraging the adoption of responsible and co-ordinated vulnerability disclosure and management processes, as well as encouraging and protecting security researchers; and
9. Sharing, as appropriate, with operators and other actors, appropriately aggregated statistical data from incident reporting;
V. RECOMMENDS that Adherents establish evidence-based monitoring and supervision cycles to i) evaluate and appraise implementation of requirements by operators, and ii) enable continuous improvement of policies, legal frameworks and self-regulatory schemes in order to meet the expected level of protection.
VI. RECOMMENDS that Adherents integrate digital security risk to critical activities in national risk management such that:
1. National risk assessments enable identification of critical activities and their operators, taking into consideration the critical activities’ value chain; and
2. Operators are encouraged to conduct a cyclical enterprise risk assessment to identify critical functions necessary to ensure provisioning of critical activities.
MEASURES FOR OPERATORS
VII. RECOMMENDS that Adherents ensure that operators:
1. are responsible to manage digital security risk to critical functions with a view to protecting the continuity, resilience and safety of critical activities that they enable; and
2. effectively reduce the digital security risk to critical functions to a level acceptable for society, consistent with national risk assessment, by encouraging or requiring, where appropriate, that they take governance, protection, detection and response, and resilience measures. Such measures should include:
a. Governance – establishing an organisational framework for cyclical digital security risk assessment and treatment
i. Assigning responsibility for digital security risk management to the highest level of leadership;
ii. Integrating digital security risk management and digital security governance within their overall cyclical enterprise risk management framework;
iii. Adopting an internal digital security risk management policy that defines:
a) Responsibilities and modalities for accountability with respect to digital security risk ownership, assessment and treatment, residual risk acceptance, and processes to review digital security risk-related decisions; and
b) Modalities to ensure that digital security risk management is systematically integrated into strategic and operational decisions related to the use of digital technologies; and that leaders and decision makers are informed and supported by digital security experts;
iv. Mapping the operator’s digital ecosystem, including internal and external dependencies to identify the components that are essential to the critical functions;
v. Conducting cyclical digital security risk assessments of critical functions, taking into account the operator’s digital ecosystem and the potential impact that digital security incidents could have on the critical activities of the operator itself, on third parties, in particular other operators in the same and in other sectors, and on the economy and society as a whole;
vi. Determining, on the basis of the digital security risk assessment, the level of digital security risk to be reduced, transferred, avoided, and accepted (risk treatment);
vii. Performing periodical digital security audits;
viii. Investing in digital security training and skills development; and
ix. Fostering best digital security risk management practice along the supply chain.
b. Protection – implementing appropriate security measures to reduce digital security risks to critical functions
i. Determining security measures related to the operator’s digital architecture, system administration, personnel training, digital security maintenance as well as physical security;
ii. Maintaining appropriate identity management, authentication and access control measures;
iii. Determining measures related to data security, including the protection of data at rest and in transit; and
iv. Sharing with the government and experts, as appropriate, information about the economic and social impacts of incidents with a view to improving digital security public policy frameworks.
c. Detection and Response – putting in place processes and measures to defend against and respond to incidents
i. Setting up security information and event management, incident detection and monitoring operations, and carrying out appropriate analyses;
ii. Setting up incident management processes and measures as well as response capabilities (e.g. CERTs) and up-to-date procedures for handling response and analysis of incidents;
iii. Reporting, as appropriate, incidents, including near-misses according to their level of criticality, to a relevant government body and/or other relevant entities or fora (e.g. sectoral cooperation fora); and
iv. Communicating, as appropriate, incidents to the public as soon as possible.
d. Resilience – adopting appropriate preparedness and recovery measures to ensure the continuity of critical functions
i. Adopting strategic objectives and recovery plans for business continuity, crisis management, and disaster recovery which take safety into account;
ii. Testing and improving business continuity, crisis management and disaster recovery plans regularly, including by organising, co-organising and participating in internal, cross-operator, cross-sector and cross-border exercises; and
iii. Ensuring that the operator’s business decision makers are leading crisis management planning and implementation, with the support of digital security technical experts.
TRUST-BASED PARTNERSHIPS
VIII. RECOMMENDS that Adherents promote and build trust in sustainable partnerships to ensure that digital security risk management of critical activities appropriately takes account of dependencies across sectors and borders. To that effect, Adherents should:
1. Develop partnerships for policy development and implementation through:
a. An open dialogue at the national level between operators and relevant government bodies to determine and implement the measures that operators should take, taking into account the specificities of each sector as well as the business, resources, regulatory, and market constraints of operators, including small and medium-sized enterprises;
b. Support for private-private cooperation and structured dialogue among operators within and across sectors, as well as with other relevant private actors (e.g. vendors), to foster exchanges on digital security expertise, threats and risk management;
c. Ongoing dialogue between digital security and sectoral experts to improve mutual understanding of their respective specificities and constraints; and
d. Bilateral and multilateral co-operation to share knowledge and experience with respect to domestic policies, practices and co-ordinating models with operators, and to facilitate collective action to:
i. manage digital security risk to critical activities with cross-border dependencies and interdependencies; and
ii. address cross-sector and sector-specific digital security vulnerabilities, threats, incidents and impacts on critical activities.
2. Strengthen operational co-operation by:
a. Fostering partnerships for co-operation among operators within and across sectors and borders, on incident prevention, detection, and response with a view to encouraging information sharing and exchange on threats, vulnerabilities, incidents, impact and risk management practice;
b. Creating the conditions for formal and informal co-operation between operators when it does not already exist, including without government participation if it could impact trust relationships among partnerships' participants;
c. Creating the conditions for digital security exercises to take place with relevant operators, within and across sectors and borders, in order to strengthen digital security preparedness, test and improve strategic decision making and co-ordination mechanisms;
d. Encouraging operators to participate in international or regional networks for watch, warning and incident response to enable information sharing and co-ordination at the operational level, as well as to better manage crises in case of an incident developing across borders;
e. Supporting cross-border collaboration for, and information sharing on, public-private research and development for digital security of critical activities, including on methodologies for impact assessment of digital security incidents; and
f. Supporting advanced research, fostering innovation and working together to develop digital security risk management skills and knowledge that will help create a skilled workforce for the future.
3. Set up trust conditions for sustainable partnerships by ensuring that:
a. the aims and values of partnerships are shared by partners and transparent to the public;
b. the roles and responsibilities of the various parties involved are clear;
c. partnerships are based upon clear rules accepted by all partners so that partners’ actions are reliable, predictable, and consistent over time;
d. partners mutually benefit from the partnership over time, including by creating the conditions for operators to share information with and receive information from the government; and
e. the information shared by operators and the government:
i. is disclosed on a voluntary basis, only to the appropriate audiences, and subject to information sharing protocols;
ii. is managed in a responsible manner, according to a set of rules governing its receipt, retention, use and dissemination consistent with privacy and personal data protection regulations, and other regulations protecting the confidentiality of information (e.g. trade secrets). Such rules should in particular ensure that personal data unrelated to a digital security threat is removed prior to any exchange of information; and
iii. will only be used for defensive purposes.
f. the confidentiality of risk and risk management-related information shared by operators with the government is protected so as not to unnecessarily expose the operator's reputation and commercial interest.
INTERNATIONAL CO-OPERATION
IX. RECOMMENDS that Adherents actively co-operate at international level by:
1. Sharing:
a. information regarding the roles and responsibilities of government bodies and other relevant stakeholders in charge of digital security risk management of critical activities with other Adherents’ counterparts to improve timeliness of cross border co-operation;
b. experience on the development and implementation of policies to identify good practice and, insofar as possible, minimise differences across countries; and
c. aggregated statistical data from incident reporting, as appropriate, and work together to ensure the international comparability of such statistics.
2. Supporting capacity building efforts to assist other countries in the development and implementation of their policy on digital security of critical activities, as appropriate.
X. INVITES the Secretary-General and Adherents to disseminate this Recommendation.
XI. INVITES Adherents to the Digital Security Risk Recommendation to take due account of, and adhere to, this Recommendation.
XII. INSTRUCTS the Committee for Digital Economy Policy to:
a. Serve as a forum for:
i. exchanging information on digital security of critical activities to identify good practice in coordination with other international fora, and
ii. for developing analytical work to support the implementation of the Recommendation;
b. Monitor the implementation of this Recommendation and report to Council within five years of its adoption and at least every ten years thereafter.