National Cybersecurity Standards & Trusted Personnel

NATIONAL CYBERSECURITY STANDARDS & TRUSTED PERSONNEL

Core Principle

Cybersecurity should be treated as basic national infrastructure.

Organizations that control:

• money;

• critical infrastructure;

• sensitive personal data;

• government systems;

• telecommunications;

• healthcare;

• energy;

• transportation;

• major digital platforms

should meet clear minimum cybersecurity standards.

The United States already has federal cybersecurity institutions and technical expertise.

The objective should be to establish clear national standards and enforce them according to risk rather than create overlapping and conflicting requirements across dozens of agencies.

CISA as the Federal Cybersecurity Standards Lead

The Cybersecurity and Infrastructure Security Agency should serve as the principal federal technical standards body for civilian cybersecurity baselines.

CISA should establish national minimum cybersecurity standards in coordination with relevant sector regulators.

Standards should be:

• risk-based;

• technically specific;

• regularly updated;

• scalable according to organization size and importance;

• technology-neutral where possible.

Risk-Based Cybersecurity Tiers

Cybersecurity requirements should increase according to the consequences of failure.

Tier I — Ordinary Businesses

Basic requirements may include:

• multifactor authentication;

• secure passwords;

• software patching;

• backups;

• basic employee cybersecurity training.

Tier II — Sensitive Businesses

Organizations handling substantial:

• financial data;

• healthcare data;

• consumer identity information;

• payment systems

should face stronger requirements.

Tier III — Critical Infrastructure

Organizations involving:

• power;

• water;

• banking;

• telecommunications;

• hospitals;

• defense;

• major cloud computing;

• transportation;

• nuclear systems

should meet substantially higher standards.

Independent Cybersecurity Certification

Critical organizations should undergo periodic independent cybersecurity assessments.

Auditors should verify:

• access controls;

• backups;

• network segmentation;

• patch management;

• incident-response capability;

• supply-chain security;

• recovery capability.

Certification should focus on actual security outcomes rather than paperwork alone.

Trusted Personnel in Critical Positions

People with privileged access to critical systems should meet appropriate trust and competency requirements.

This may include positions involving:

• national cybersecurity infrastructure;

• bank settlement systems;

• digital-asset custody;

• government networks;

• critical infrastructure control systems;

• highly sensitive data;

• encryption keys;

• major financial transaction systems.

Background Screening

Personnel holding extremely sensitive access may undergo lawful background screening.

Relevant disqualifying concerns may include serious convictions involving:

• fraud;

• financial theft;

• cybercrime;

• espionage;

• terrorism;

• identity theft;

• corruption.

Background screening should not become an ideological loyalty test.

Political beliefs, protected speech, lawful associations, or unpopular opinions should not disqualify someone from technical employment.

Professional Competence

Critical cybersecurity and financial personnel should demonstrate appropriate competence through:

• education;

• professional certification;

• verified experience;

• technical examination;

• other objective standards.

A job title alone should not establish qualification.

Continuous Trust Based on Conduct

Trust should be based on conduct and risk rather than permanent suspicion.

Organizations may maintain appropriate monitoring of privileged administrative actions, but employees should retain ordinary privacy rights outside legitimate security monitoring.

Conflict-of-Interest Disclosure

Personnel responsible for:

• digital-asset regulation;

• financial-system oversight;

• major cybersecurity procurement;

• government technology contracts

should disclose material financial conflicts.

Regulators should not secretly regulate assets or companies in which they hold significant personal financial interests.

Post-Quantum Cybersecurity

Federal agencies and operators of designated critical infrastructure must inventory systems using vulnerable public-key cryptography within one year and publish or submit a risk-ranked migration plan within two years. National-security, financial, healthcare, emergency-communications, and long-lived sensitive records receive priority. New federal procurements must use approved quantum-resistant standards once those standards are operationally available.

• High-impact systems should complete migration within five years unless an independent technical review grants a time-limited waiver.

• Waivers must identify the technical barrier, compensating controls, responsible official, funding plan, and expiration date.

• Migration requirements must use open, tested standards and avoid locking agencies into one vendor.

• Agencies must report annual progress, failed migrations, security incidents, and remaining high-risk systems to Congress and the appropriate Inspector General.

Related policies: Digital Assets, Stablecoins & Financial Technology; Data Centers & Digital Infrastructure; Artificial Intelligence, Synthetic Media & Automated Accounts; Military; Privacy Rights.

Status: Proposed / Draft — not yet formally adopted.

Originally published: September 25, 2026.

Last updated: September 25, 2026.

Version: Draft 0.2.