Companies are often required to collect sensitive data from consumers, such as personally identifiable information. This sensitive data is a target for cyberattacks. In response, governments worldwide have been working to establish strong data privacy standards. Prominent examples are the EU’s 2018 General Data Protection Regulation and the 2020 California Consumer Privacy Act. Other states are following California’s lead, resulting in uneven consumer protections and a complex minefield of standards to which companies will struggle to adhere.

The best solution for keeping consumers’ sensitive private data secure is a comprehensive national standard. Such regulation would address how to define and protect sensitive personal data and de-identified data; establish minimum standards of protection and care; and outline uniform rules governing data protection, security, breach notification, and regulatory oversight. This unform approach will ensure the greatest security for consumers while simultaneously mitigating excessive costs and complexities for the companies that store their information.

Artificial intelligence (AI) is rapidly transforming every sector, from healthcare and education to national security and finance. While its potential to drive innovation and efficiency is undeniable, the technology’s accelerated pace of development has outstripped existing regulatory frameworks. As AI becomes more powerful and pervasive, the risks of misuse, unintended consequences, and ethical dilemmas grow exponentially. Congress must step in to create guardrails that ensure AI is developed and deployed responsibly, safely, and equitably.
One pressing concern is the lack of transparency in how AI systems make decisions, often described as the “black box” problem. Without clear oversight, these systems could inadvertently embed biases, perpetuate inequalities, or make critical errors in high-stakes scenarios such as criminal justice, hiring, or autonomous vehicles. Congressional action is needed to mandate transparency, accountability, and fairness in AI algorithms to prevent harm and build public trust.

Additionally, AI poses significant national security risks. Adversarial nations and cybercriminals are increasingly leveraging AI for disinformation campaigns, cyberattacks, and espionage. The NTSC strongly encourages Congress to work with federal agencies like the Cybersecurity and Infrastructure Security Agency (CISA) to develop standards for securing AI systems against malicious exploitation.

Congress has a unique opportunity—and responsibility—to establish the guardrails needed to harness AI’s benefits while addressing its challenges. Through thoughtful regulation, including measures to enforce transparency, bolster security, and promote ethical development, lawmakers can ensure AI serves as a force for good in society rather than a source of harm. Delays in action could result in unchecked risks, eroded public trust, and loss of global competitiveness. The time to act is now.

Creating a CISO Safe Harbor is a critical consideration in today’s stringent cyber regulatory environment, where Chief Information Security Officers (CISOs) often face intense scrutiny during security breaches. The concept aims to provide CISOs with legal and professional protections, encouraging them to implement robust security measures without fear of undue personal liability.

The regulatory landscape has heightened expectations for CISOs to ensure compliance with evolving cybersecurity laws, such as SEC disclosure requirements and state-level data protection statutes. Additionally, recent high-profile breaches have spotlighted CISOs, raising concerns about individual accountability and liability.

A CISO Safe Harbor framework could offer protections for CISOs who demonstrate good-faith efforts to secure their organizations. These efforts might include implementing industry best practices, adhering to regulatory requirements, maintaining transparency in risk reporting, and aligning with frameworks like NIST or ISO. By codifying such protections, organizations and regulators can incentivize proactive cybersecurity leadership, ensuring that CISOs can focus on risk mitigation without the threat of disproportionate penalties.

This approach would foster a collaborative rather than punitive environment, encouraging CISOs to address cyber threats while mitigating personal risks associated with their role.

Securing the software supply chain is essential to protecting critical systems from cyber adversaries who exploit vulnerabilities in third-party components, dependencies, or updates. A single compromise in the supply chain can cascade into widespread disruptions or breaches, making it vital for organizations to adopt proactive measures.

One effective approach is CISA’s Secure by Design initiative, which emphasizes building security into software from the ground up rather than treating it as an afterthought. Integrating secure coding practices, rigorous testing, and transparent supply chain processes help ensure software is resilient to exploitation.

Secure by Design, combined with practices like dependency management, vendor scrutiny, and real-time monitoring, create a robust defense against emerging threats, protecting organizations and the ecosystems they support.