Top-down approach --- Maybe if it was a top-down approach, implementation might be easier? for instance, govts can mandate that organisations of a certain size and in certain areas of work follow some minimum standards. They can also ensure that govt contracts with all third-parties prescribe some standards for cybersecurity and non-maintenance would be in breach of the contract. This practice would then become part of contracts between companies as well and even smaller and medium sized companies will be incentivsed to implement cybersecurity measures in order to protect commercial interests.

Source author: Pavitra Ramanujam pavitra.ramanujam@gmail.com