Policy complexity

Cybersecurity is a complex policy issue due to multidimensional threats spanning legacy systems, skills shortages, human error, supply chain issues, plus environmental disruptions on digital infrastructure (ENISA, 2024). Such complexity is heightened across the range of attributes impacting cybersecurity policy development, such as: telecommunication, network, cloud computing, e-commerce, online banking, smart grid, consumer rights, cybercrime, encryption, privacy, identity theft, digital signature, data security, and spam (Mishra et al., 2022).

Policy uncertainty

Pressure and uncertainty about governance abounds as the number of data breaches) and cyber attacks) intensify across all sectors and jurisdictions. Cybersecurity policy is therefore never static, but rather a continuous process spanning multiple attributes: governance, identification, protection, detection, response, and recovery efforts (NIST, 2024).

Policymaking possibilities

National strategies, such as the Australian Cyber Security Strategy emphasise the need for continual and close consultation with industry and community to achieve national cyber resilience (Australian Government, 2023). Ultimately there is no one-size-fits all policy approach to cybersecurity - as each organisation (industry, government, academic, or nonprofit) will vary in relation to its risk appetite and tolerance, technologies, mission, and objectives (NIST, 2024).