The regulatory environment for cyber has undergone significant changes in the past year. The Trump administration shifted toward a more nuanced approach, both in terms of oversight and implementation of cyber risk compared with how the Biden administration regulated it. That means oversight in the information security space is not going away but instead will allow markets forces more room to operate.

“Rather than uniformly pulling back or pursuing broad regulatory expansion, the government is continuing to assess where clearer expectations, coordination, or enforcement are warranted in response to a dynamic threat landscape,” said Haiman Wong, resident fellow, cybersecurity and emerging threats at the R Street Institute.