Cybersecurity Regulation: It’s Not ‘Performance-Based’ If Outcomes Can’t Be Measured

A closer look at the TSA’s cybersecurity directive for pipelines casts doubt on the applicability of “performance-based” regulation to cybersecurity. For now, policymakers have to combine management-based controls and technology-specific prescriptions.

cybersecurity cybersecurity regulation outcomes performance regulation