LB 525 - Agricultural Data Zero Trust Manifesto

PREPARED BY AGRASOFT

Through our work in agricultural data security and privacy, we have come to value:

• Verified Identity and Access over unlimited data availability.

• Data Minimization and Purpose Specification over unrestricted collection.

• Continuous Monitoring and Assessment over periodic reviews.

• Risk-Based Controls over universal permissions.

• Individual Privacy Rights over operational convenience.

That is, while we value the items on the right, we value the items on the left more.

---

Principles:

1. Our highest priority is to protect sensitive agricultural data through  continuous verification and validation of every access attempt, regardless of source or location.

2. Agricultural data should be collected, used, and shared only for specified, permissionsed, controlled and legitimate purposes, with demonstrable identity and access controls at every step.

3. We embrace awareness of the ag data threat landscapes and security requirements. Zero trust processes must be harnessed for secure, permissioned, monitored ag data exchange, from seedtime to harvest.

4. Farm operators, agronomists, and technologists must work together cooperatively to implement and maintain zero trust principles across all agricultural systems.

5. Build data handling processes around privacy and ownership aligned stakeholders. Give them the environment and support they need to protect data privacy, and trust them to get the job done within verified boundaries.

6. The most efficient and effective method of sharing ag data between supply chain parties and stakeholders is by explicit consent data exchanges using, secure encrypted communication channels.

7. Secure agricultural data is the primary measure of progress. Privacy-preserving techniques must be demonstrable and measurable.

8. Zero trust processes promote sustainable development. The stakeholders should be able to maintain a constant pace indefinitely.

9. Continuous attention to technical excellence and good design enhances data security.

10. Simplicity--the art of maximizing the amount of work not done while maintaining security--is essential.

11. The best architectures, requirements, and designs emerge from self-organizing teams that understand both agriculture and security.

12. At regular intervals, the team reflects on how to become more effective at protecting agricultural data, then tunes and adjusts its behavior accordingly.

---

Supporting Practices:

• Implement the principle of least privilege

• Verify explicitly before granting access

• Use encryption in transit and at rest

• Monitor and log all data access and movements

• Maintain detailed data inventories and flows

• Conduct regular privacy impact assessments

• Enforce data classification and handling procedures

• Practice security-first incident response

• Train all stakeholders in privacy and security practices

• Establish clear data governance structures

---

This manifesto embraces both NIST Privacy Framework's emphasis on individual privacy rights and risk management, and NIST SP 800-171's focus on protecting controlled unclassified information. 

It adapts these frameworks for the unique challenges of agricultural data, where protecting sensitive farm data is crucial for both individual privacy and national security.

I've crafted this manifesto to bridge the gap between traditional unlimited data ag data  sharing in agriculture and modern zero trust principles. It maintains the spirit and structure of the Agile Manifesto while incorporating key elements from both NIST frameworks.

---