Commission on Enhancing National Cybersecurity

This executive order establishes a 12-member advisory Commission on Enhancing National Cybersecurity within the Department of Commerce to develop detailed recommendations for strengthening public and private sector cybersecurity over the next decade. The Commission must submit a final report by December 1, 2016, and will terminate within 15 days thereafter unless extended by the President.

Federal Register Open PDF 81 FR 7441

Impact dates

Jan 15, 2017
Presidential response and public website publication of report
Dec 16, 2016
Commission termination (within 15 days after presenting final report)
Dec 1, 2016
Final report to President due

Key directives

Establish Commission on Enhancing National Cybersecurity within Department of Commerce
Appoint not more than 12 members with specified expertise areas
Develop recommendations addressing next decade of cybersecurity actions
Submit final report to President by December 1, 2016
Publish final report on public website with Presidential response within 45 days
Commission terminates within 15 days after presenting final report unless extended
NIST to provide expertise, services, funds, facilities, staff, equipment to Commission
Hold periodic public meetings in open and transparent environment

Who is ordered

Timeline

Immediate

Commission establishment within Department of Commerce
Secretary appoints Executive Director and staff

Near term (90d)

Commission membership appointment and designation of Chair/Vice Chair
Initial public meetings and subcommittee formation
Consultation with experts and incident-affected entities begins

Long term

Final report due December 1, 2016
Commission termination within 15 days after report submission
Potential decade-long implementation of recommendations if adopted

Risks & tensions

Advisory-only nature limits direct enforceability; impact depends on subsequent Presidential and Congressional action
Tight 10-month timeline from establishment to final report may constrain depth of analysis for decade-long recommendations
Restriction on federally registered lobbyists and current Federal employees may narrow available expertise pool
Requirement to avoid duplicating other governmental efforts may create coordination challenges with existing cybersecurity bodies
Vague 'to the extent permitted by law' and 'subject to availability of appropriations' language creates resource uncertainty