This document explains the history of the controller/processor distinction and demonstrates how widely that distinction has been adopted in global privacy laws.
The following recommendations are designed to enhance cybersecurity, improve the effectiveness and efficiency of the US Government, set the Nation on a path for sustained growth, and better serve the American people.
To build a cyber incident reporting ecosystem that serves governments’ needs while not unduly encumbering businesses’ ability to respond to and recover from cyber incidents, cyber incident reporting requirements should follow these recommendations.