President to Introduce Largely Self-Regulatory Cyber-Security Proposal, with Government Powers to Shape and Shame

If the US government wants to look at a company’s plan it can do so. If the government finds a company’s plan deficient, it can publicly announce that fact — though it cannot impose a fine.
=====
I wonder if Obama will also want them to disclose their political donations.

who, or what, is the “3rd Party” who is doing the auditing? Who is paying them? Who is auditing them? Will they have any liability for security breaches or secret company data leaked out during their audits?
Is this simply another scheme to allow “big players” to push out small companies because they won’t be able to afford the new regulations, liability, and government pubic censure? Will smaller companies have an input on this “3rd Party” who will audit everyone?

I can’t believe anyone would object to companies being safer internet-wise.
Honestly, with the amount of damage that could be done by cyber-threats, shouldn’t we be better prepared?
Or do some people just love to complain…about anything.

“Others argue that without the threat of fines, companies will not take the appropriate measures – as evidenced by the current state of affairs, which has myriad vulnerabilities”
I have to agree- in my professional experience I have yet to work with a company that would take cyber-security seriously on the basis of moral principal. The reality of the situation is that companies are not obligated to act with moral conscious. They are obligated to act with fiscal responsibility to their investors/owners who, in a free market, are motivated by profit. The end game- if it impacts profit (i.e. costs money), then it doesn’t get approved. Now- having said this- if it can be demonstrated that spending some green up front will significantly reduce the risk of an expensive fine ( the fine would have to be about twice the amount of whatever you are trying to get budgeted/approved here) and the probable occurrence of the risk was high enough to be downright scary (like a 75% chance) then you might be able to motivate management to spend the dollars to secure themselves. Unfortunately, moral conviction- in my humble experience- has only ever come up as a reason AFTER it was decided that the risk of a fine was very high. – oh, well.
In an earlier post someone asked about the meaning of “3rd party audit”- this would be an audit that is completely independent of the subject being audited. Generally, these audit reports would be shared with the corporations audit committee before the conclusion of the audit and management responses would be expected. Once all the findings are finalized with management’s input, the report would be sent to the requesting entity, in this case, I suppose, the Federal department/office responsible for enforcement of the Act. We will see.

certain entities (government, utilities, etc) should have some of these regulations for security. But this policy would seem to apply to A LOT of companies, industries, and businesses in America. Another layer of bureaucrats and costs. Another opportunity for the government and unelected regulators to pick “winners”.
The market SHOULD correct other companies that don’t have security policies.
Unfortunately in the Bush/Obama times of bailouts, “too big to fail”, and regulatory agency creep companies don’t have incentive to do so. You bet if their stock-price, financial liability, and/or criminal liability was on the table companies would come up with security!
However, having some agency will likely lead to zero-liability, bailouts, etc and ability of companies to say “we complied”, “we were audited” and so not seek the most robust security for their businesses but only provide the minimum level demanded by the government.