The U.S. Department of State, in consultation with industry and other federal agencies as appropriate, should promote a system of norms, built through international engagement and cooperation, that promotes responsible behavior in cyberspace and over time reduces cyber risk to critical infrastructure. Such a framework should build on existing agreements and include confidence building measures and enforcement. The U.S. government should focus on helping foreign governments on norms implementation, building and partnering with allies to hold nation-state actors accountable for cyber activity that deviates from norms of responsible behavior, and working on identifying gaps in established norms.

The U.S. should also assess whether existing government and non-governmental initiates that focus on increasing the stability in cyberspace, such as the Global Commission on the Stability of Cyberspace or the Paris Call for Trust and Stability in Cyberspace would benefit from their endorsement.