NATIONAL CYBERSECURITY STANDARDS & TRUSTED PERSONNEL
Core Principle
Cybersecurity should be treated as basic national infrastructure.
Organizations that control:
money;
critical infrastructure;
sensitive personal data;
government systems;
telecommunications;
healthcare;
energy;
transportation;
major digital platforms
should meet clear minimum cybersecurity standards.
The United States already has federal cybersecurity institutions and technical expertise.
The objective should be to establish clear national standards and enforce them according to risk rather than create overlapping and conflicting requirements across dozens of agencies.
CISA as the Federal Cybersecurity Standards Lead
The Cybersecurity and Infrastructure Security Agency should serve as the principal federal technical standards body for civilian cybersecurity baselines.
CISA should establish national minimum cybersecurity standards in coordination with relevant sector regulators.
Standards should be:
risk-based;
technically specific;
regularly updated;
scalable according to organization size and importance;
technology-neutral where possible.
Risk-Based Cybersecurity Tiers
Cybersecurity requirements should increase according to the consequences of failure.
Tier I — Ordinary Businesses
Basic requirements may include:
multifactor authentication;
secure passwords;
software patching;
backups;
basic employee cybersecurity training.
Tier II — Sensitive Businesses
Organizations handling substantial:
financial data;
healthcare data;
consumer identity information;
payment systems
should face stronger requirements.
Tier III — Critical Infrastructure
Organizations involving:
power;
water;
banking;
telecommunications;
hospitals;
defense;
major cloud computing;
transportation;
nuclear systems
should meet substantially higher standards.
PHYSICAL CYBER ISOLATION, MANUAL CONTROL & SAFE LOCAL OPERATION
A software button is not a physical cybersecurity boundary. A critical system that can affect electricity, water, fuel, transportation, communications, healthcare, defense, public safety, industrial processes, building access, or another physical function must be capable of safe local control when its external network, remote vendor, cloud service, or primary control center is compromised or unavailable.
Tier III critical infrastructure, and any Tier II system whose remote compromise could cause death, serious injury, major property damage, widespread service loss, or a significant national-security event, must include a risk-appropriate physical means to isolate external communications and remote command paths.
A REAL HARDWARE CONTROL
The required isolation control must interrupt power, signal, or another necessary hardware path to the covered network interface or remote-command component. A touch-screen control, application setting, voice command, software flag, firmware instruction, or manufacturer-controlled cloud command does not satisfy this requirement by itself.
When placed in isolation:
software, firmware, a manufacturer, a utility, a vendor, a government agency, an attacker, or any other remote party cannot restore the severed connection;
the system provides a visible and locally verifiable indication tied to the actual hardware state rather than a software representation alone;
restoration requires an authorized person physically present at the protected location or another independently protected local control point;
the event, operator, time, affected segment, and restoration are recorded in a tamper-evident local audit log; and
the system enters a documented safe local condition rather than failing into an uncontrolled or unnecessarily destructive state.
SEGMENTED ISOLATION, NOT ONE NATIONAL KILL SWITCH
Critical infrastructure must not depend on one universal switch capable of disabling an entire facility, region, sector, or national system. Isolation must be segmented so trained operators can separate a compromised network, control zone, vendor connection, or remote-access path while preserving unaffected equipment and essential protective functions.
High-criticality safety systems should use physically separate network equipment where practicable. Communications between operational zones must be denied by default and permitted only when documented as necessary. Unidirectional gateways, data diodes, dedicated switches, independent control paths, and other protective architectures should be used according to risk.
MANUAL CONTROLS & LOCAL CONTINUITY
A covered facility must identify the essential functions that must continue during network isolation and maintain a tested local method to monitor, control, shut down, restart, or place those functions in a safe condition.
Protective relays, emergency shutdown, fire protection, pressure relief, life-safety alarms, and other independent safety functions must remain available unless isolation of a specific compromised component is itself necessary for safety.
Manual controls must be understandable, labeled, maintained, and accessible to trained on-site personnel.
The operator must maintain offline copies of essential procedures, diagrams, configurations, recovery software, and contact information.
Remote access must be disabled by default when not needed and must use separately authorized, logged, time-limited access when enabled.
Restoring an isolated high-consequence segment should require two authorized people unless an immediate life-safety emergency makes the second authorization impossible. The exception must be documented and reviewed.
SAFETY-BASED ALTERNATIVE
If a full physical disconnection would itself create a greater danger, the operator may use a certified physical safe-isolation mode. That mode must sever nonessential external access and remote actuation while preserving only the communications and automated protective functions independently shown to be necessary for immediate safety.
An operator claiming this alternative must document the hazard, the minimum functions preserved, the hardware boundary, the parties able to communicate with the system, and why a less connected design is not safe. An independent sector regulator or accredited assessor must approve and periodically revalidate the exception.
TESTING & CERTIFICATION
A covered facility must test physical isolation and essential manual or local operation at least twice each year.
At least one annual exercise must assume loss or compromise of normal remote access, cloud services, primary communications, and ordinary operator workstations.
Tier III facilities must receive annual independent verification of the isolation boundary, safe local operation, recovery process, and correction of prior findings.
A material test failure must be reported to the responsible regulator within 72 hours and receive a funded corrective-action plan within 30 calendar days.
Sensitive technical details remain protected, but the regulator must publish aggregate completion, failure, correction, and overdue-remediation data.
IMPLEMENTATION SCHEDULE
Within 18 months of enactment, CISA, NIST, and the responsible sector regulators must publish risk-based technical standards and approved test methods after public review and protected consultation with operators and security experts.
A new covered system procured more than 24 months after the final standard must comply before operational acceptance.
An existing covered facility must complete an inventory and risk-ranked retrofit plan within 12 months after the final standard.
The highest-consequence existing systems must be corrected within three years and all other covered systems within five years, unless the sector regulator approves a shorter or longer evidence-based schedule for safety, feasibility, or supply-chain reasons.
Federal funds may support necessary modernization, especially for public water, rural utilities, hospitals, and other essential providers with limited resources. Payment must follow verified milestones, not unsupported promises.
NO SECRET REMOTE CONTROL
The physical-isolation requirement may not be used to create a government, manufacturer, utility, or vendor backdoor. No covered system may be required to include a secret remote shutdown, undisclosed master credential, universal override, or mechanism that defeats the local hardware boundary.
Core MPA standard: If a remote connection can control something capable of harming people, property, essential services, or national security, responsible local operators must have a real physical way to cut that connection while keeping the system safe.
Independent Cybersecurity Certification
Critical organizations should undergo periodic independent cybersecurity assessments.
Auditors should verify:
access controls;
backups;
network segmentation;
patch management;
incident-response capability;
supply-chain security;
recovery capability.
Certification should focus on actual security outcomes rather than paperwork alone.
Trusted Personnel in Critical Positions
People with privileged access to critical systems should meet appropriate trust and competency requirements.
This may include positions involving:
national cybersecurity infrastructure;
bank settlement systems;
digital-asset custody;
government networks;
critical infrastructure control systems;
highly sensitive data;
encryption keys;
major financial transaction systems.
Background Screening
Personnel holding extremely sensitive access may undergo lawful background screening.
Relevant disqualifying concerns may include serious convictions involving:
fraud;
financial theft;
cybercrime;
espionage;
terrorism;
identity theft;
corruption.
Background screening should not become an ideological loyalty test.
Political beliefs, protected speech, lawful associations, or unpopular opinions should not disqualify someone from technical employment.
Professional Competence
Critical cybersecurity and financial personnel should demonstrate appropriate competence through:
education;
professional certification;
verified experience;
technical examination;
other objective standards.
A job title alone should not establish qualification.
Continuous Trust Based on Conduct
Trust should be based on conduct and risk rather than permanent suspicion.
Organizations may maintain appropriate monitoring of privileged administrative actions, but employees should retain ordinary privacy rights outside legitimate security monitoring.
Conflict-of-Interest Disclosure
Personnel responsible for:
digital-asset regulation;
financial-system oversight;
major cybersecurity procurement;
government technology contracts
should disclose material financial conflicts.
Regulators should not secretly regulate assets or companies in which they hold significant personal financial interests.
Post-Quantum Cybersecurity
Federal agencies and operators of designated critical infrastructure must inventory systems using vulnerable public-key cryptography within one year and publish or submit a risk-ranked migration plan within two years. National-security, financial, healthcare, emergency-communications, and long-lived sensitive records receive priority. New federal procurements must use approved quantum-resistant standards once those standards are operationally available.
High-impact systems should complete migration within five years unless an independent technical review grants a time-limited waiver.
Waivers must identify the technical barrier, compensating controls, responsible official, funding plan, and expiration date.
Migration requirements must use open, tested standards and avoid locking agencies into one vendor.
Agencies must report annual progress, failed migrations, security incidents, and remaining high-risk systems to Congress and the appropriate Inspector General.
Related policies: Digital Assets, Stablecoins & Financial Technology; Data Centers & Digital Infrastructure; Artificial Intelligence, Synthetic Media & Automated Accounts; Military; Privacy Rights; Energy; Environment, Conservation & Natural Resources; Product Quality, Durability & Consumer Standards.
Status: Proposed / Draft — not yet formally adopted.
Originally published: September 25, 2026.
Last updated: September 30, 2026.
Version: Draft 0.3.