THE COUNCIL ,
HAVING REGARD to Article 5 b) of the Convention on the Organisation for Economic Co-operation and Development of 14 December 1960;
CONSIDERING that the OECD has worked on digital security since the adoption in 1992 of the first international standard on digital security, the Recommendation of the Council concerning Guidelines for the Security of Information Systems [ OECD/LEGAL/0271 ], and that it has been at the cutting edge in this area updating its standard in 2002 with the Recommendation of the Council Concerning Guidelines for the Security of Information Systems and Networks - Towards a Culture of Security [ OECD/LEGAL/0312 ] and in 2015 with the Recommendation of the Council on Digital Security Risk Management for Economic and Social Prosperity [ OECD/LEGAL/0415 ], which this Recommendation partially replaces;
HAVING REGARD to the Recommendation of the Council on Digital Security Risk Management [ OECD/LEGAL/0479 ] (Digital Security Recommendation); the Recommendation of the Council on Digital Security of Critical Activities [ OECD/LEGAL/0456 ]; the Recommendation of the Council on Digital Security of Products [ OECD/LEGAL/0481 ], the Recommendation on the Treatment of Digital Security Vulnerabilities [ OECD/LEGAL/0482 ], the Recommendation of the Council concerning Guidelines for Cryptography Policy [ OECD/LEGAL/0289 ], and the Recommendation on Electronic Authentication [ OECD/LEGAL/0353 ], which form with the present Recommendation a comprehensive set of international standards on digital security featured in the OECD Policy Framework on Digital Security [ C(2022)145/ADD1 ];
HAVING REGARD to the standards developed by the OECD in the area of privacy and transborder flows of personal data; Internet and internet policy making; digital economy, innovation, growth and social prosperity; artificial intelligence; digital government strategies; and public procurement;
RECOGNISING that while digital transformation brings significant benefits to individuals, businesses, and governments in all economic sectors and aspects of social life, it also exposes all stakeholders to digital security risk that could lead to financial losses, disruptions or interruptions of activities, theft of intellectual property, reputational damages, breaches of data and privacy, and threats to freedom of expression, losses of competitiveness, as well as physical and environmental damages;
RECOGNISING that digital security risk increases notably as a result of the rising digital dependence of all stakeholders, the growing complexity of products and digital ecosystems on which stakeholders rely to carry out their activities, the emergence of disruptive technologies such as artificial intelligence and 5G mobile networks, the increasing number, persistence and sophistication of cybercriminals and State-supported malicious actors;
RECOGNISING that, to realise the benefits of digital transformation, a whole-of-government and whole-of-society strategic approach is essential to create a culture of digital security across the economy and society, and that it requires collaborative efforts between the public sector, the private sector and all categories of stakeholders;
RECOGNISING that some stakeholders such as individuals, small- and medium-sized enterprises, some public sector bodies, civil society organisations, journalists and human right activists have insufficient resources and skills to manage digital security risk.
On the proposal of the Committee on Digital Economy Policy:
I. AGREES that the purpose of this Recommendation is to provide guidance on how to implement the Digital Security Recommendation in order to develop or update national digital security strategies, or national cybersecurity strategies, which articulate a clear vision to:
1. Create the conditions for all stakeholders to manage digital security risk to economic and social activities, to foster trust and confidence in the digital environment, to strengthen security and resilience, and to facilitate digital transformation of the economy and society;
2. Take advantage of the open digital environment for economic and social prosperity by reducing the overall level of digital security risk within and across borders without unnecessarily restricting the flow of technologies, communications and data;
3. Enhance the digital security of critical activities to ensure their continuity and resilience, and ensure the co-ordination of stakeholders in case of crisis;
4. Ensure consistency and complementarity between policies focusing on economic and social aspects of cybersecurity (i.e. digital security) and policies addressing the national security, international security, technical as well as cybercrime law enforcement aspects of cybersecurity;
5. Create a culture of digital security and protect individuals as well as public and private organisations from digital security threats while taking into account the need to safeguard national and international security, and to preserve human rights and fundamental values;
INSTITUTIONAL FRAMEWORK
II. RECOMMENDS that Members and non-Members adhering to this Recommendation (hereafter the “Adherents”) set up an institutional framework in order to adopt a new or update an existing national strategy, and to support its implementation. To that effect, Adherents should:
1. Set up intra-governmental coordination and an open and transparent process involving all stakeholders to develop or update the strategy;
2. Ensure that the strategy is supported at the highest level of government and articulate a clear and whole-of-government approach that is flexible, technology-neutral and coherent with other strategies fostering economic and social prosperity, including digital transformation, skills, education, industrial, and innovation strategies;
3. Assign clear responsibilities to one or more existing or new government bodies for the development of digital security public policies and for their implementation, while ensuring co-ordination with other relevant ministries and agencies in areas such as criminal law enforcement, sectoral regulation, privacy and personal data protection, consumer protection, consumer product safety, innovation, education, digital government, and foreign affairs;
CONTENT OF THE STRATEGY
III. RECOMMENDS that Adherents ensure that their national strategy is directed at all stakeholders, tailored as appropriate to small and medium enterprises and to individuals, and articulates stakeholders’ joint responsibility and accountability according to their roles, ability to act and the context in which they operate, and, to that effect, Adherents should:
1. Awareness raising and skills
a. Raise the level of awareness, skills and empowerment across society to manage digital security risk through technology-neutral initiatives tailored to the specific needs of the different categories of stakeholders;
b. Support the development and retention of a skilled workforce that can manage digital security risk and meet the job market needs, in particular by addressing digital security risk management in broader skills strategies. This could include fostering the development of in-service risk management training and certification, and supporting the development of digital security skills across the population, including through gender inclusive education programmes at all educational stages, and targeting both technical and non-technical students in tertiary education;
2. Responsible incident response & vulnerability coordination
a. Facilitate the establishment of one or more trusted Computer Security Incident Response Team (CSIRT), also known as Computer Emergency Response Team (CERT), at national level and, where appropriate, encourage the emergence of public and private CSIRTs and other organisations such as Information Sharing and Analysis Centres (ISACs), working collaboratively, including across borders, to respond to incidents and facilitate vulnerability co-ordination;
b. Encourage private actors to respond to cyber attacks in a responsible manner, discourage them to carry out any form of counter attack (“hack back”) when responding to incidents, directly or through a private third-party, and discourage the provision or procurement of counter attack services by private actors;
3. Risk management standards
a. Encourage the use of international standards and best practices on digital security risk management, and promote their development and review through open, transparent and multi-stakeholder processes;
4. Cybersecurity industry, research, innovation
a. Encourage the development of a cybersecurity industry;
b. Coordinate and promote public research and development on digital security risk management with a view to fostering innovation;
c. Encourage innovation in digital security risk management as well as in the development of tools that individuals and organisations can use to protect their activities in the digital environment;
5. Digital security of products and services, and vulnerability treatment
a. Provide incentives to stakeholders to manage digital security risk, enhance the digital security of products and services, and increase market transparency and efficiency;
b. Encourage all stakeholders to treat digital security vulnerabilities, and to co-ordinate the disclosure of vulnerabilities;
6. Individuals and SMEs
a. Encourage all stakeholders to work together to help protect individuals and small and medium enterprises from digital security threats and increase their ability, skills and resources to manage digital security risk to their economic and social activities, taking into account their role, ability to act and the context;
7. Sectoral digital transformation
a. Anticipate digital security challenges related to disruptive digital transformation in specific sectors such as smart transports, financial services, energy or health, and encourages stakeholders to integrate digital security risk in their sectoral digital transformation vision and plans;
b. Encourage most vulnerable public sector bodies to strengthen their digital security risk management;
8. Trusted partnerships
a. Create the conditions for all stakeholders to collaborate in the management of digital security risk, notably by fostering active participation from relevant stakeholders in mutually trusted initiatives and partnerships whether private or public-private, formal or informal, at domestic, regional and international levels to:
i. Share knowledge, skills and successful experience and practices in relation to digital security risk management at policy and operational levels;
ii. Exchange information related to digital security risk management and improve identification and remediation of vulnerabilities and threats, as well as mitigation of digital security risk;
iii. Anticipate and plan for future challenges and opportunities;
9. International co-operation
a. Strengthen international co-operation and mutual assistance, notably by:
i. Participating in relevant regional and international fora, and establishing bilateral and multilateral relationships to share experience and best practices; and promoting an approach to national digital security risk management that does not increase the risk to other countries;
ii. Providing, on a voluntary basis as appropriate, assistance and support to other countries, for example through capacity-building programmes, and establishing national points of contacts for addressing cross-border requests related to digital security risk management issues in a timely manner, without prejudice to existing frameworks;
iii. Working to improve responses to domestic and cross-border threats, including through CSIRTs co-operation, coordinated exercises and other tools for collaboration, without prejudice to existing frameworks.
iv. Encouraging the development of internationally comparable risk metrics based on common measurement methodologies, standards and best practices, as appropriate, to improve effectiveness, efficiency and transparency in the management of digital security risk.
IMPLEMENTATION OF THE STRATEGY
IV. RECOMMENDS that Adherents adopt policies and initiatives to implement the strategy, starting with voluntary mechanisms and considering mandatory requirements, as appropriate, in particular if voluntary mechanisms prove insufficient. To that effect, Adherents should:
1. Allocate sufficient resources ;
2. Engage with other stakeholders , notably by:
a. Making use of established multistakeholder fora and communities and benefitting from their expertise;
b. Exploring how governments and other stakeholders can help each other to better manage digital security risk to their activities;
c. Identifying and addressing potential negative impacts that government public policies may have on other stakeholders’ activities or national economic and social prosperity;
d. Establishing practices and procedures for digital security risk management, made known to the public.
3. Lead by example , notably by:
a. Adopting a comprehensive framework to manage digital security risk to the government’s own activities, coherent with its digital government strategy. The framework should be transparent in order to foster trust and confidence in government activities and behaviour, including with respect to responsible disclosure of the digital security vulnerabilities they have identified, and related mitigation measures;
b. Establishing co-ordination mechanisms among all relevant governmental actors to ensure that their management of digital security risk is compatible and enhances economic and social prosperity;
c. Using their market position to foster digital security risk management across the economy and society, including through public procurement policies, and the recruitment of professionals with appropriate risk management qualification;
d. Adopting innovative security techniques to manage digital security risk in order to assure that information is appropriately protected at rest, in process, as well as in transit, and taking into account the benefits of appropriate limitations on data collection and retention;
4. Assess, review and improve the strategy and implementation policies regularly based on experience, best practices, feedback received, new risks, and sectoral plans, where appropriate, using internationally comparable metrics where available, and sharing results with the public.
***
V. INVITES the Secretary-General to disseminate this Recommendation.
VI. INVITES Adherents to disseminate this Recommendation at all levels of government.
VII. INVITES non-Adherents to the Digital Security Recommendation to take due account of, and adhere to, this Recommendation.
VIII. INSTRUCTS the Committee on Digital Economy Policy, through the Working Party on Security in the Digital Economy, to:
a. Serve as a forum for:
i. exchanging information on digital security to identify good practice in coordination with other international fora, and
ii. developing analytical work to support the implementation of this Recommendation;
b. Report to the Council on the implementation, dissemination, and continued relevance of this Recommendation when reporting on the Digital Security Recommendation.