What Business Needs to Know About the New U.S. Cybersecurity Strategy

In March 2023, the Biden administration released a new National Cybersecurity Strategy, which makes it clear that the time for private companies voluntarily opting into cybersecurity has long passed. Instead, the new strategy promises to support new regulatory frameworks that will shift liability and create incentives for private firms to defend against critical vulnerabilities. This article discusses three concrete things business leaders should know about the new strategy. First, every company will need to identify their distinct vulnerabilities and risks. Second, companies will then need to adopt measures that address those vulnerabilities. Third, the strategy categorically states that it will push for legislation to hold these firms liable when they fail to live up to the duty of care they owe consumers, businesses, or critical infrastructure providers.