Identifying and Prioritizing Systemically Important EntitiesAdvancing Critical Infrastructure Security and Resilienceby John Bordeaux, Jonathan W. Welburn, Sasha Romanosky, Benjamin Boudreaux, Aaron Strong Publisher RAND Corporation Published Date 2023 Page Count 98 Categories Business & Economics / Infrastructure, COMPUTERS / Data Science / General, Computers / Security / General, Mathematics / General, Political Science / Terrorism, Technology & Engineering / Mobile & Wireless Communications Language EN Average Rating N/A (based on N/A ratings) Maturity Rating No Mature Content Detected ISBN 1977409849 In response to the mounting specter of systemic cyber risks, the Cyberspace Solarium Commission recommended that Congress codify the concept of Systemically Important Critical Infrastructure--later renamed Systemically Important Entities (SIEs)--and that the Cybersecurity and Infrastructure Security Agency (CISA) be resourced to identify SIEs and support in the mitigation of their risks to support a broader national strategy of layered deterrence. In support of the CISA National Risk Management Center (NRMC), this report clarifies the concepts of SIEs and introduces a data-driven methodology for their identification and prioritization. Specifically, the authors identify SIEs by their potential to affect national critical functions (NCFs) and prioritize SIEs by measures of their size and interconnectedness. This report builds on existing work regarding Critical IT Products and Services and extending the researchers' analysis to federal agencies and firms that install potentially vulnerable software, in addition to firms that write software. This report further documents systemic risks and cyber risks in software supply chains, past and ongoing analytical support to CISA, and current limitations, and it outlines a path for future work. More Information