Policy instruments to strengthen the cybersecurity of critical infrastructure

Critical infrastructure (CI) systems are increasingly vulnerable to cyberthreats. Despite growing awareness, private-sector control and persistent market failures have hindered uniform cybersecurity adoption, necessitating more active government intervention. This paper addresses the need for an integrated policy response by examining three classes of instruments – authority-based ‘sticks’, incentive-based ‘carrots’ and information-based ‘sermons’ – used to influence CI operator behaviour. Drawing on comparative examples from the United States and the European Union, the paper outlines how these instruments function independently and in combination to promote cybersecurity. It then applies this framework to Canada, evaluating recent legislative, financial and informational efforts to secure CI. The analysis finds that while Canada has made significant progress, particularly in framing cybersecurity as a shared societal responsibility, its policy mix remains fragmented and heavily reliant on voluntary compliance. The paper concludes that a more coordinated and sequenced deployment of tools – tailored to sectoral capacity and linked to performance outcomes – is essential to strengthening Canadian CI cybersecurity.