Cyber Resilience Regulation in Critical Public Infrastructure

Abstract

Background: The practical operation of policy relating to cyber resilience differs across settings, suggesting a need to examine implementation capacity and institutional design directly.

Objective: This study sought to explain differences in the implementation of cyber resilience by examining institutional responsibility, administrative capacity, and critical infrastructure.

Methods: Evidence from 9 jurisdictions and 11 institutions was assessed in a mixed-method observational design. Standardized coding of documentary and administrative material was supplemented where appropriate by stakeholder or practitioner data, followed by descriptive and multivariable analysis.

Results: Procedural consistency for cyber resilience was achieved by approximately 33% of institutions. Better coordination was linked to a 9% improvement in the main outcome, while the implementation weaknesses most frequently recorded were capacity constraints and unclear responsibility.

Conclusion: The findings underline a practical gap between formal policy on cyber resilience and the institutional work required to deliver it consistently. This means that resilience improves when cybersecurity duties are operationalized through consistent controls, capable teams, and cross-agency coordination.

Study design: sectoral compliance study.

Publication history: Originally published in print on 15 June 2024, Volume 4, Article 8. Online abstract record added on 16 September 2026. Full-text PDF will be added when the digital galley is ready.