Cyber Safety Review Board (CSRB)
A US public board created in 2021 to investigate major cyber incidents the way aviation accident boards do, whose members were dismissed in January 2025.
Civil aviation owes much of its safety to independent investigations that look for the causes of an accident without looking for someone to blame. The Cyber Safety Review Board was meant to bring that method over: government and private sector representatives review a major incident and publish recommendations. It had no subpoena power, which limited its investigations to the cooperation of the companies involved. Its reports still mattered for insurance, because they publicly established facts that litigation and forensic work take years to reconstruct, and they named the failures of vendors on which thousands of policyholders depend. Its suspension halted the investigation into the espionage campaign against telecom carriers.
Created by Executive Order 14028 of May 12, 2021, the board published a July 2022 report on Log4j, which it called an endemic vulnerability for a decade, then an April 2024 report on Storm-0558 describing a cascade of security failures at Microsoft. On January 21, 2025, the Department of Homeland Security terminated its members' appointments, in the middle of its Salt Typhoon investigation.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.