What kind of legal enforcement? --- I think it's fair and about time to talk about some level of enforcement, but I think the bigger question is how to put this in place in a way that is actually effective. By this I mean that legislation is a difficult and time-intensive process. Laws are slow to be put into place and practice. In contrast, in the case of cybersecurity what counts as a good standard can advance and change so much and so quickly. Maybe it would be more productive to pick one or more of the standard-setting organisations we already have in place and make it mandatory for software companies to reach a minimum level of safety determined by said agencies.

Source author: Gustavo Paiva gdp.direito@gmail.com