Federal Regulations on Cybersecurity

Rising digitization has increased both the frequency and impact of cyber-attacks, pushing governments to issue federal regulations that define minimum cybersecurity standards and share hard-earned lessons across industries. Although cyber threats are global, most regions prefer national or regional frameworks that can be adapted locally. The text compares three major initiatives: U.S. Executive Order (E.O.) 14028 (2021), the EU NIS Directive (2016, with NIS 2.0 forthcoming), and Germany’s IT Security Act 2.0 (IT-SIG 2.0, 2021). Together, they aim to reduce theft, disruption, and systemic failure by strengthening prevention, detection, response, and cooperation.

Recent incidents illustrate why urgency is high: the Colonial Pipeline ransomware attack disrupted fuel supply and increased prices; SolarWinds spread via a compromised software update and injected a “Sunburst” backdoor; Microsoft Exchange was exploited at scale via an undisclosed vulnerability; DoppelPaymer crippled a German university hospital, halting operations and contributing to a patient death; Sandworm used spear-phishing to bypass defenses; and Maze combined encryption with data theft and extortion threats.

E.O. 14028 focuses on federal networks and contractors, pushing concrete measures such as zero trust, MFA, encryption, endpoint detection and response, incident playbooks, log requirements, supply-chain baseline standards, and a Cybersecurity Safety Review Board. The NIS Directive emphasizes national strategies, CSIRTs, EU-wide cooperation, and incident reporting obligations for essential services and digital service providers, leaving technical specifics to member states. IT-SIG 2.0 translates NIS expectations into detailed German operational requirements, expands BSI powers, extends scope to additional sectors and “companies of special public interest,” and introduces labeling and revised fines—while also attracting criticism around centralization risk, timelines, and penalties. The recommendations emphasize proactive posture, treating “voluntary” standards as de facto future expectations, and learning laterally from others’ incidents.

• Executive Order 14028 was signed on May 12, 2021 to improve U.S. federal cybersecurity, information sharing, and incident response.
• The EU NIS Directive was issued in summer 2016 as the first EU-wide cybersecurity legislation.
• Germany’s IT Security Act 2.0 (IT-SIG 2.0) was published in May 2021 after multiple drafts beginning in March 2019.
• Colonial Pipeline transported nearly half of the U.S. East Coast’s fuel supply and was impacted by ransomware attributed to the DarkSide group.
• The SolarWinds compromise used a tainted software update to install a backdoor called “Sunburst.”
• Volexity detected early 2021 attacks exploiting an undisclosed Microsoft Exchange vulnerability before Microsoft’s planned March 9 update.
• Hafnium launched large-scale Exchange attacks on Feb. 26, 2021, leading Microsoft to release updates on March 2.
• DoppelPaymer encrypted 30 servers at the University Hospital in Düsseldorf, shutting down core operations and forcing emergency services closure.
• Sandworm used spear-phishing emails in early 2019 to target governments, political organizations, and media in Germany and other EU countries.
• Maze targeted Einhell in late 2019, involving data theft and threats to publish the stolen data.

• “Security and efficiency can also go hand in hand!”
• “For this to work, one simple key insight is required: most companies are not special; they just feel special.”
• “Be proactive and not reactive; the bad boys are too!”
• “Statements used to start with ‘if we get breached...’ but increasingly management is changing its perspective to ‘ when we get breached...’.”
• “The bad guys are not waiting for companies to strengthen their defenses; they are not playing nice nor fair.”
• “These regulations drive future standards, not irrelevant money burners!”
• “Consider yourself affected by the regulation, even if you are not!”
• “It is up to companies to decide whether they are first or late movers.”
• “Look left and right, evolution happens for a reason!”
• “Attacks that have worked once will be repeated elsewhere until they no longer work.”