iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A 2025 assessment by CSC 2.0 says U.S. cyber-defense progress is “stalling and, in several areas, slipping.” Its evidence is a reversal in the implementation status of recommendations from the U.S. Cyberspace Solarium Commission—not a measure of cyberattacks, overall national security, or the percentage of U.S. cybersecurity that is working.
What the report measured
Published October 22, 2025, CSC 2.0’s 2025 Annual Report on Implementation tracks the status of the original 82 recommendations issued by the U.S. Cyberspace Solarium Commission in 2020. The commission’s original work drew on more than 300 interviews and proposed a broad national strategy for cyber deterrence. The original report overview describes that work.
The 2025 report’s executive summary states: “Our nation’s ability to protect itself and its allies from cyber threats is stalling and, in several areas, slipping.” That is the assessment’s conclusion about whether its recommendations are being implemented and sustained. It is not a direct national score of cyberattack outcomes.
How the recommendation ratings changed
The charts below use the same 82 recommendations and category labels in each year. Percentages may not total exactly 100% because of rounding.
#1 Best Overall
| Implementation category | 2024 assessment | 2025 assessment |
|---|---|---|
| Fully implemented | 47.6% | 35.4% |
| Nearing implementation | 31.7% | 34.1% |
| On track | 12.2% | 17.1% |
| Progress limited | 7.3% | 11.0% |
| Significant barriers | 1.2% | 2.4% |
In the 2024 assessment, about 80% of recommendations were fully implemented or nearing implementation, with another 12% on track. In the 2025 chart, the fully implemented share is 35.4%, down from 47.6% the prior year; the shares in the other categories are higher. The year-to-year comparison is about implementation classifications, not a change in measured attack rates or threat severity. The 2024 Annual Report on Implementation provides the prior-year assessment.
Why CSC 2.0 says momentum weakened
The report attributes the setback to institutional and resource concerns. It says key reforms are vulnerable to underinvestment and bureaucratic gridlock, while technology is evolving faster than federal efforts to secure it. It also points to cuts to cyber diplomacy and science programs and a lack of stable leadership at CISA, the State Department, and the Department of Commerce as factors eroding momentum.
These are the report’s explanations for the weaker implementation picture, not independent findings that quantify how much each factor caused it. The report’s central warning is that policy progress can be fragile when agencies lack sustained capacity and leadership.
What the report asks policymakers to do
CSC 2.0’s five priorities for the Trump administration and Congress are to:
Rank #3
- Enhance the authority of the Office of the National Cyber Director (ONCD).
- Restore CISA’s workforce and funding.
- Restore cyber diplomacy capacity at the State Department.
- Strengthen public-private collaboration.
- Sustain the institutional capability needed to carry out national cyber policy.
These are recommendations in the report; their inclusion does not mean they have been adopted.
The strategy behind the recommendations
The commission’s broader approach is layered cyber deterrence: shape adversary behavior with allies and partners, deny adversaries benefits from hostile activity, and impose costs for that activity. The stated goal is to reduce the likelihood and impact of significant cyberattacks. Its original recommendations span six pillars, covering government structure; international norms and non-military tools; resilience; the cyber ecosystem; public-private collaboration; and military instruments. CSC 2.0’s organization background describes the commission’s continuing work.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What the “slipping” conclusion does—and does not—mean
The ratings show CSC 2.0’s assessment of progress on a defined set of policy recommendations. They do not establish that 35.4% of U.S. cybersecurity is implemented, that every part of federal cyber defense has deteriorated, or that cyberattacks increased by a particular amount. A recommendation moving out of “fully implemented” signals a loss of that status under the assessment; it is not, by itself, a measure of real-world resilience or threat severity.
Free tools Windows power users keep installed
One-click scans. No signup required.
The report’s finding is therefore best read as a warning about the durability and execution of cyber policy reforms. Its figures identify a reversal in recommendation implementation, while its policy proposals focus on institutional capacity, continuity, and coordination.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
