Balancing cybersecurity and deregulation in 2025

The new US administration presents a paradox for business leaders: widespread deregulation across most sectors while simultaneously tightening cybersecurity regulations for national security and critical infrastructure. This dual approach creates unique challenges for CISOs who must navigate reduced regulatory burdens in some areas while facing heightened accountability in cybersecurity.

While deregulation aims to promote innovation and economic growth by eliminating bureaucratic hurdles, cybersecurity faces the opposite trajectory. High-profile breaches like the National Public Data incident exposing 2.9 billion records, combined with average breach costs exceeding $4.8 million, underscore why cybersecurity cannot be treated as secondary. Companies with national security ties should expect more rigorous reporting requirements and mandatory risk assessments.

“As regulatory expectations evolve, a commitment to strong cybersecurity through transparent and ethical security practices demonstrates accountability. In an era where reputational risk is just as critical as operational risk, cybersecurity is no longer just a compliance requirement but a competitive differentiator.”
— Mark Houpt, Chief Information Security Officer, DataBank

Organizations must proactively implement robust security frameworks like NIST, leverage both AI technology and skilled talent, and foster transparency to maintain trust. While deregulation creates growth opportunities, it also demands greater self-regulation and accountability. Companies that embrace innovation while strengthening cybersecurity posture will thrive in this evolving regulatory landscape.