Software Maker Liability Is Elusive Target of Biden Cyber Plan

[BumRushDaShow]

2. I think the micromanaging to that level might not be necessary

and what might be more critical is the "finished product" and it is up to whoever distributes that "finished product" to ensure the pieces of it are secure (whether it is GNU or BSD or some commercial or otherwise proprietary code or whatever).

What was interesting from the framework document was this (pg. 26 of the PDF) -

STRATEGIC OBJECTIVE 3.6: EXPLORE A FEDERAL CYBER INSURANCE BACKSTOP

When catastrophic incidents occur, it is a government responsibility to stabilize the economy and
provide certainty in uncertain times. In the event of a catastrophic cyber incident, the Federal
Government could be called upon to stabilize the economy and aid recovery. Structuring that
response before a catastrophic event occurs—rather than rushing to develop an aid package after
the fact—could provide certainty to markets and make the nation more resilient. The
Administration will assess the need for and possible structures of a Federal insurance response to
catastrophic cyber events that would support the existing cyber insurance market. In developing this
assessment, the Administration will seek input from, and consult with, Congress, state regulators,
and industry stakeholders.

The above sounds like creation of a pool of funds that companies can contribute to that can be used to mitigate financial impacts of malicious attacks against their software, forestalling some of the need to keep taking huge hits to their bottom lines after civil actions.

It's an interesting idea and would probably take time to hash out but even brainstorming use of it might be worthwhile.