International Cybersecurity Regulation: Implications for Russia

Owing to the wide-scale implementation of computer systems, the necessity of the critical infrastructure (CI) cybersecurity regulation has become urgent within the framework of state cybersecurity. In this regard, during the past decade legislators of developed countries have designed the regulatory field to protect computer systems of the CI from external cyberthreats. Russian legislation in the sphere of the CI cybersecurity protection is only beginning to develop, and therefore it is important to introduce risk assessment into regulatory impact assessment procedures, which has not been properly disseminated in domestic practice yet, to avoid unreasonably high adjustment costs and unnecessarily strict regulation, before implementing concrete measures. This paper aims to assess the prospects for implementing CI cybersecurity measures in OECD countries and Russia in industries with strong (civil aviation) and soft (telecommunications) regulation with the use of regulatory impact assessment procedure based on the risk-oriented approach by comparing the cost-benefit balance of regulation for economic agents. To achieve this aim, foreign experience of CI cybersecurity regulation was analyzed, key stakeholders were indicated and costs and benefits for each of them were calculated with use of risk-based approach. The results of this study provide the basis for further research of the critical infrastructure cybersecurity regulation applicability for Russia.