…
…
”
}
Let me write out the final JSON now.{
“title”: “Why Cybersecurity Needs More Public Accountability: Deadlines, Documents, and Claims You Can Verify”,
“html”: “
Public accountability in cybersecurity means security claims that people outside the organization making them can actually check. A claim qualifies when it traces to a primary document, an open standard, or a procedure anyone can repeat. Security that cannot be checked still gets sold, signed, and budgeted on the strength of adjectives, and the people who carry the consequences â readers, sources, clients, employees â learn how thin the evidence was only after a breach. This article names the deadlines already written into law, shows where claims escape scrutiny, and leaves you with checks you can run today.
The audience is specific: journalists, activists, small-business owners, and non-technical professionals in the EU and North America. The civic calendar already supplies the pressure points â a procurement hearing, a reauthorization vote, a supervisory authority’s docket, a patch window that closes on a fixed date. This site treats open security as a civic practice: transparent, verifiable, and rights-based. Public accountability is the part of that practice anyone can operate, starting this afternoon.
What Public Accountability in Cybersecurity Means
Start with the definition. Public accountability in cybersecurity is the practice of making security claims verifiable by people outside the organization making them â security transparency with deadlines attached. Three tests decide whether a claim qualifies. Traceable: it points to a primary source anyone can read, such as Binding Operational Directive 22-01, Article 33 of the GDPR, or RFC 9116. Time-bound: it carries a deadline an outsider can watch, such as a 72-hour notification clock or a patch window. Repeatable: it survives a procedure a non-specialist can run, such as fetching a security.txt file or comparing a vendor’s patch record against a public catalog.
Give the failure mode its name: security by assertion, a claim resting on the speaker’s authority alone. Phrases like military-grade encryption, bank-level security, and enterprise-grade protection belong to that family. The open-standard counterexample is AES. FIPS 197, published by NIST in 2001, defines the algorithm in public, and its test vectors let anyone check an implementation. The accountable version of the sentence we use AES-256 names the mode, the key-management arrangement, and the date of the last audit. Everything else is atmosphere.
The Deadlines Already Exist â Few People Outside the Industry See Them
Urgency in security writing is usually manufactured. The urgency here is different: the clocks below are already running, they are written into public law, and most of the people they protect have never read a word of them.
Patch windows: the CISA Known Exploited Vulnerabilities Catalog
Binding Operational Directive 22-01, issued by CISA in November 2021, orders US federal civilian agencies to fix vulnerabilities on the Known Exploited Vulnerabilities Catalog within two weeks for entries added in 2021 and three weeks for entries added from 2022 onward. The catalog is public and updated continuously, which makes it a yardstick anyone can borrow: when a vulnerability affecting a product you depend on appears there, a clock the US government already considers reasonable has started.
What this does not cover: BOD 22-01 binds federal civilian agencies, not private companies, and the catalog lists vulnerabilities with confirmed exploitation, not every risk. Absence from the catalog is not evidence of safety.
Do today: search the catalog for the three products your organization depends on most. Two minutes, and you have a baseline.
Statutory clocks: NIS2 in the EU, GDPR for personal data
The NIS2 Directive (EU) 2022/2555 sets a three-stage clock for essential and important entities: an early warning to the national CSIRT within 24 hours of becoming aware of a serious incident, an incident notification within 72 hours, and a final report within one month. Member states had until 17 October 2024 to transpose it into national law. Most missed the deadline, and in November 2024 the European Commission opened infringement proceedings against twenty-three of them. The first public test of the law was whether governments could meet their own writing deadline, and the result is on the record.
GDPR runs alongside it. Article 33 requires a controller to notify its supervisory authority within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to the people concerned. Article 34 requires telling those people without undue delay when the risk is high. If an organization cannot say who owns that clock, when it started, or what it triggered, that is an answer too. Write the question down before the next incident, not after.
What this does not cover: health, finance, and energy carry their own sectoral clocks, and national transposition of NIS2 varies by member state â our NIS2 response-clock primer tracks the national versions. Verify the statute that applies to you before relying on any timeline here for a compliance decision.
Do today: bookmark your national CSIRT or data protection authority’s incident-reporting page and paste the URL into your incident plan. If no incident plan exists, that is your next deadline.
Where Security Claims Escape Scrutiny
Most security evidence is private, and the privacy runs one way: the buyer signs the contract, the seller keeps the evidence behind a non-disclosure agreement. Three escape routes deserve particular attention.
SOC 2. A Type II report can be genuine evidence that controls operated over a period of time, but the full report usually travels only under NDA, and buyers often see a one-page letter instead. The accountable questions are dull and answerable: What period does the report cover? Which Trust Services Criteria were tested? Which systems were in scope? A report that excludes the system holding your data is a report about someone else’s security.
ISO/IEC 27001. A certificate says a management system meets the standard within a stated scope. The scope statement is the entire document as far as accountability goes, and it is often narrower than the sales pitch. Ask for it in writing; a refusal is data.
Procurement is where the balance is slowly shifting. In the United States, OMB memo M-22-18 (September 2022) began requiring software producers selling to federal agencies to attest to secure development practices, with a common attestation form published by CISA in 2024. In the EU, the Cyber Resilience Act phases in vulnerability-handling and SBOM duties for products with digital elements across 2026 and 2027. Public buyers are turning security claims into signed, dated documents. Private buyers can copy the method now: put the attestation in the contract.
Journalists and researchers hold one more instrument: records law. FOIA in the United States and Regulation (EC) No 1049/2001 in the EU open agency files, with statutory response clocks â twenty business days under FOIA â and state and provincial laws reach municipal ones. Security contract annexes, audit findings, and incident timelines have all surfaced through records requests. The procedures are public; the volume of security-relevant requests remains strikingly low.
What this does not cover: none of this forces an organization to be secure. It forces the organization to be specific, and specificity is what outside scrutiny works on.
Four Checks You Can Run This Week
Each check below cites its primary source, states what the result does not prove, and takes under thirty minutes. No security team required.
1. Read a security.txt file (RFC 9116)
RFC 9116, published by the IETF in April 2022, defines a plain-text file organizations place at /.well-known/security.txt to tell researchers where vulnerability reports should go. Checking a service takes one browser tab: https://example.com/.well-known/security.txt. The file must carry a Contact field, and the Expires field tells you whether it is current. A missing file, an expired one, or a contact address that bounces is a documented, citable signal that inbound reports have no owner. Our step-by-step security.txt check walks through the details.
What this does not prove: a current file shows a policy exists, not that anyone reads the reports or fixes them.
Do today: check the three services behind your newsletter, your donor database, and your website. If one is missing, send the vendor a two-line email citing RFC 9116.
2. Score a vendor’s patch record against the KEV catalog
Pick one product you run and search the catalog for its vendor. Each entry carries the CVE identifier, the date it was added, and the due date under BOD 22-01; the vendor’s own advisories carry the fix date. Two columns and a subtraction give you a patch-latency number you can put in a procurement file and quote in a hearing.
What this does not prove: the catalog covers exploited vulnerabilities, not the vendor’s whole backlog, and it says nothing about flaws nobody has reported yet.
Do today: build the table for one product and set a quarterly reminder to update it.
3. Ask for the parts list: an SBOM in SPDX or CycloneDX
A software bill of materials names the components inside a product the way a food label names ingredients. SPDX is standardized as ISO/IEC 5962 and CycloneDX is an OWASP open standard, so the request is precise: your SBOM, in SPDX or CycloneDX format. The Cyber Resilience Act will make this a standing expectation for products with digital elements sold in the EU; nothing stops you from asking early.
What this does not prove: an SBOM names components; it does not grade them. The checking still has to happen.
Do today: add one sentence to your next purchase order or renewal email.
4. Test a reproducible-build claim
When a project says its builds are reproducible, independent parties can compile the published source and compare the results bit for bit. The Reproducible Builds project publishes the procedures, and several major Linux distributions run programs whose results anyone can compare. This is the strongest verifiable claim software can make: the release becomes checkable rather than believable.
What this does not prove: reproducibility says the binary matches the source, not that the source is good.
Do today: if you distribute software to sources or clients, read the project’s definition page and note whether your build process could support it.
If You Adopt One Framework, Adopt the Free One
In February 2024, NIST released version 2.0 of its Cybersecurity Framework and did something quiet but consequential: it added a sixth function, GOVERN, and put it first. Roles and responsibilities, policy, oversight, and supply-chain risk now open the most widely used open framework in the field, ahead of Identify, Protect, Detect, Respond, and Recover. For a small organization, GOVERN is mostly a writing exercise, and writing is what accountability is made of.
What this does not cover: CSF 2.0 is a framework, not a checklist. It organizes questions without answering them for your context, and it substitutes for none of the statutory duties above.
Do today: download the framework and the small-business quick-start guide from NIST’s CSF page, then write one GOVERN answer: who sets your patch deadlines, and for what date each month.
Build Accountability Into Your Own Operation
Accountability is not only something you demand from vendors; it is something you publish. A four-person newsroom can put most of this in place in an afternoon.
- Publish a vulnerability disclosure policy with a security.txt file. Name a contact, set an expiry date you will actually renew, and keep the promise. Thirty minutes to set up.
- Adopt a written patch calendar anchored to two public sources: your vendors’ advisories and the KEV catalog. The calendar is the accountability; the patching is the point.
- Put three questions into your next contract, in writing: the ISO/IEC 27001 scope statement or the SOC 2 period and criteria, the vendor’s KEV patch record, and the URL of their security.txt. Written answers are quotable, and quotable is what turns a sales process into a record.
- If you cover public institutions, file the records request. The security annex of a public contract is a document, documents have request procedures, and the response clocks bind the agency too.
What this does not cover: incident response, legal advice, and cyber insurance are separate disciplines. This list is the accountability layer, not the whole of security.
Frequently Asked Questions
What is public accountability in cybersecurity?
It is the practice of making security claims checkable by people outside the organization making them: every claim traceable to a primary document, an open standard, or a repeatable procedure, with public, measurable deadlines. The alternative is security by assertion.
What reporting deadlines already apply in the EU and North America?
GDPR Article 33 sets a 72-hour clock for notifying a supervisory authority once a controller becomes aware of a personal data breach. NIS2 sets a 24-hour early warning, a 72-hour incident notification, and a final report within one month for covered entities. In the United States, BOD 22-01 requires federal civilian agencies to patch KEV-listed vulnerabilities within two to three weeks. State, provincial, and sectoral rules add further clocks, so check the statutes where you operate.
What is security.txt, and how do I check one?
A standardized plain-text file defined in RFC 9116, published at /.well-known/security.txt, that tells researchers where to send vulnerability reports. Open the URL for the service in question and look for a Contact field and an unexpired Expires field. A missing or stale file is a citable finding, not an opinion.
How can a small business check a vendor’s security claims without a security team?
Ask for written evidence outsiders can read: the ISO/IEC 27001 scope statement, a SOC 2 report’s period and criteria, the vendor’s KEV patch record, an SBOM in SPDX or CycloneDX format, and a current security.txt. None of these requests requires a security team behind it.
Does an ISO 27001 certificate mean my data is protected?
No. The certificate attests that a management system meets the standard within a stated scope. Whether your data falls inside that scope is a separate question, answered by the scope statement rather than the seal.
Where should a journalist start with security accountability reporting?
With deadlines and documents. The KEV catalog turns patch latency into a number, statutory clocks turn response failures into dates, and records law opens the contracts and audits behind both. Start with one agency and one product.
The Step You Can Complete Today
Run the security.txt check on the three services your work depends on most. Three browser tabs, about three minutes. For every missing or expired file, send a two-line email citing RFC 9116 and asking when a current file will appear. That is the whole loop â one person, one check, one written question, one dated answer. Public accountability in cybersecurity is not a mood; it is that loop, repeated until vendors expect the question and agencies answer it on the record.
Kira Mikkonen edits open-security.org’s accountability coverage and has spent the past decade reading the primary documents behind other people’s security claims. Tips and corrections are welcome, especially the kind that arrive with a document attached.