This paper argues that large technology platforms have, in effect but informally, become what the U.S. government terms “critical infrastructure.” The author makes the case that with such companies essential to both U.S. economic and national security, they ideally should work closely together plus collaborate with the government to promote security while still maintaining flexibility to support their continued innovation.

One common approach for doing so is termed “shared responsibility.” Existing shared responsibility frameworks and standards for protecting critical infrastructure, such as the National Institute of Standards and Technology Voluntary Cybersecurity Framework, can serve as a model for these technology platforms. This paper reviews four “good practices” that are tied to these frameworks.