Diana Initiative 2022-Ayan Islam-Breaking Silos: Your Operational Experience Is Needed in Legisla...

### Overview In this talk presented at Diana Initiative 2022, Ayan Islam—Associate Policy Director of Cybersecurity and Emerging Threats at the R Street Institute and former IT specialist at CISA—addresses the significant divide between frontline cybersecurity practitioners and policymakers. Islam argues that while there is an enormous workforce deficit in cybersecurity broadly, an even sharper deficit exists in legislative and policy bodies. Practitioners with operational, hands-on experience are desperately needed to inform policymaking to ensure laws, regulations, and executive actions are technically sound and operationally feasible.

### Key Topics - **Legislative Knowledge Deficit:** As of 2015, only seven out of 3,500 legislative staff had formal technology training. While programs like Tech Congress helped raise this number above 65, Congress faces an influx of proposed legislation—over 498 cybersecurity-related proposals in the current session alone, with nine passing into law. - **Operational Consequences of Policy:** Disconnects frequently arise between high-level policy mandates and frontline implementation. As an example, the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) of 2021 mandates ransomware incident and data breach reporting for critical infrastructure entities to CISA within specific timeframes. Security Operations Centers (SOCs) face practical hurdles aggregating, triaging, and automating logs to meet these compliance demands without breaking ongoing operations. - **Pathways for Engagement:** Practitioners can bridge the silo through several structured avenues: - *Fellowships:* Programs such as Tech Congress, CISA’s Innovation Fellows program, and the Google Public Policy Fellowship. - *Community & Advocacy Initiatives:* Efforts like Share the Mic in Cyber to elevate underrepresented practitioners, particularly Black cybersecurity professionals. - *Grassroots & Industry Groups:* I Am The Cavalry, sector-specific Information Sharing and Analysis Centers (ISACs) such as Aviation ISAC and Financial Services ISAC, and localized efforts like the Michigan Cyber Civilian Corps or local BSides events. - *Public Writing and Commenting:* Submitting public comments on proposed rules, publishing blog posts, and authoring op-eds.

### Technical Details & Implementation Context Islam highlights that policy decisions directly dictate technical priorities. For instance, incident reporting rules require organizations to build automated logging pipelines and incident response triage workflows capable of producing regulatory disclosures rapidly. When technical practitioners participate early—such as redlining draft bills, participating in ISAC working groups, or commenting during agency rulemaking—they help prevent regulations that create unintended operational disruption in areas like Industrial Control Systems (ICS) and SCADA environments.

### Takeaways - Cyber practitioners must view their operational experience as valuable input for public policy. - Companies should consider investing in in-house cyber policy teams that actively collaborate with software developers, engineers, and subject matter experts. - Engaging directly—via fellowship leaves of absence, industry working groups, grassroots bodies, or formal public comments—ensures that technical realities shape future cyber legislation.