“Anytime we’re putting even more obligations on somebody internal to the company and specifying new requirements, there could be grounds for some action,” said Brandon Pugh, director and a resident senior fellow for the R Street Institute’s Cybersecurity and Emerging Threats team.