Cybersecurity Obligations for Critical Infrastructure: Emerging Legal Norms, Enforcement Gaps, and Governance Challenges

Abstract

Critical infrastructure has become a focal point of global cybersecurity governance as escalating cyber threats increasingly target essential services such as energy, water, transportation, healthcare, and financial systems. This article examines the evolving legal landscape that governs cybersecurity obligations for critical infrastructure, tracing the transition from voluntary, principles-based frameworks toward binding statutory requirements that impose enforceable duties on operators. Through a narrative review and descriptive analysis of national regulations, international norms, sector-specific obligations, and emerging technological considerations, the study maps the diverse instruments shaping current governance models. The analysis highlights significant advancements, including strengthened incident reporting mandates, growing supply chain accountability, and the incorporation of cybersecurity into broader national security strategies. At the same time, the article identifies persistent enforcement gaps and structural weaknesses that undermine regulatory effectiveness. These challenges include fragmented legal approaches, capacity limitations within industry, jurisdictional conflicts in cross-border cyber operations, difficulties in attributing attacks, ambiguous public-private role divisions, insufficient supply chain oversight, and the paradoxical effects of national security secrecy on transparency and accountability. The article argues that while emerging legal norms represent substantial progress, they remain insufficient without coherent enforcement mechanisms, institutional coordination, and supportive operational capacities. Strengthening critical infrastructure cybersecurity will require integrated regulatory architectures, harmonized international cooperation, enhanced public-private collaboration, and adaptive governance capable of responding to rapidly evolving technologies and threat dynamics. The findings offer a foundational understanding of the current state of legal obligations and illuminate the systemic issues that must be addressed to ensure resilient and effective protection of critical infrastructure worldwide.