2025 Regulatory Overview: Digital and ESG Measures to Keep in Focus

Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA)USRequires critical infrastructure entities to report significant cyber incidents and ransomware payments to the US Cybersecurity and Infrastructure Security Agency (CISA)All private and public entities in critical infrastructure sectors as defined by Presidential Policy Directive 21 (PPD-21), which include entities operating in the energy, healthcare, financial services, transportation, and communications sectorsFines established through civil actions, alongside possible public disclosure ordersCyber Resilience Act (CRA)EUSets security standards and mandatory requirements for designing digital products, requiring manufacturers to manage vulnerabilities throughout the product lifecycleManufacturers that design, develop, or market PDEs under their name; importers that place non-EU PDEs on the EU market; and distributors that supply PDEs without modifying themAt least €15 million or a minimum of 2.5% of the total annual worldwide turnover (whichever is higher), alongside possible public disclosure orders, product recalls or bans, suspension of operations, and loss of licenseCybersecurity and Infrastructure Security Agency (CISA) ActUSEstablishes CISA in the Department of Homeland Security and strengthens federal protection of critical infrastructure from cyber threatsFederal agencies, state, local, tribal, and territorial governments, and all critical infrastructure operatorsPenalties for non-compliance do not exist unless mandated by other legislative actsCybersecurity LawChinaRegulates network security, personal data protection, and critical information infrastructureAll network and critical information infrastructure operators, network product providers and 3rd-party contractors, entities that deal with personal and cross-border data (if data is collected in China), and entities operating in ChinaA fine of ¥1 million, alongside possible product recalls or bans, suspension of operations, and loss of licensesDigital Operations Resilience Act (DORA)EUMandates ICT risk management frameworks for the financial sector and requires oversight of critical third-party ICT service providersMost financial entities, such as banks, investment firms, payment institutions, asset and fund managers, insurers, and crypto platforms, and 3rd-party ICT service providers offering services to financial entities, such as cloud and data service providers, software vendors, and ICT outsourcing firmsFines are set by EU Member States, while operational penalties include public disclosure orders, product recalls or bans, suspension of operations, and loss of licensesExecutive Order (EO) 14028 on Improving the Nation’s CybersecurityUSRequires federal agencies to implement security measures and software bills of materials (SBOMs) to ensure the integrity of the software supply chainAll federal agencies, critical infrastructure operators, ICT and OT service providers, cloud service providers, software (classified as critical), and hardware vendors, if under contract with federal agencies and critical infrastructure operators (CIO)No fines, but organizations could face operational penalties such as public disclosure orders, suspension of operations, and disqualification from federal contractsEU Cybersecurity ActEURegulates the European Union Agency for Cybersecurity (ENISA) and establishes a European cybersecurity certification framework for ICT products, services, and processesENISA and providers of ICT products, services, and processes only if they choose to certify their products or are mandated to do so by EU or national regulationsFines are set by EU Member States, while operational penalties include product recalls or bans and suspension of operationsIoT Cybersecurity Improvement ActUSMandates the development of minimum-security standards for IoT devices purchased or used by federal agenciesAll federal agencies that procure or manage IoT devices, IoT device manufacturers or vendors that supply IoT devices to US federal agencies, and IoT service providers for US federal agenciesNo fines, but organizations could face operational penalties such as product recall or bans, suspension of operations, loss of licenses, and disqualification from federal contractsNational Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) 2.0USGuides organizations in managing cybersecurity risks through 6 core functions: govern, identify, protect, detect, respond, and recoverAll US federal agencies, when mandated by other EOs and regulations, and critical infrastructure service providers, when mandated by EOs and legislationPenalties for non-compliance do not exist unless mandated by other legislative actsNational Security Investment (NSI) ActUKRegulates acquisitions and investments that can have national security risks and allows the government to condition acquisitions in 17 sensitive sectorsUK-based companies acquiring another UK or foreign company with UK operations or foreign companies acquiring control over UK business, assets, or intellectual propertyAt least £10 million or 5% of revenue (whichever is higher), alongside possible transaction voidingNetwork and Information Systems RegulationsUKEstablishes measures to improve the cybersecurity and resilience of critical services and implements reporting obligationsAll operators of essential services, such as energy, health, and digital infrastructure companies, as well as online marketplaces, online search engines, and cloud service providersA fine of £17 million, alongside possible public disclosure orders, product recalls or bans, suspension of operations, and loss of licensesNetwork Data Security Management RegulationChinaSecures network data in China and establishes risk assessments and strict controls on data sharing and cross-border transfersAll entities involved in network data processing within China, including data collection, storage, use, transfer, and deletion, specifically network data processors, critical information infrastructure operators, large platforms, and 3rd-party service providersA fine of ¥10 million, alongside possible product recalls or bans, suspension of operations, and loss of licensesNetwork Information Systems Directive 2 (NIS2)EUA legislative act aimed at establishing security risk management measures, regulating management compliance, and setting incident reporting procedures while repealing and replacing the original 2016 NIS Directive, addressing prior shortcomings in cybersecurity legislationPublic and private sector entities of all sizes (small, medium, and large) with domestic or foreign headquarters operating within the EU jurisdictionFines of at least €10 million or a minimum of 2% of the total annual worldwide turnover (whichever is higher), alongside operational restrictions and public disclosure ordersProduct Security and Telecommunications Infrastructure Act (PSTIA)UKImposes cybersecurity requirements on manufacturers, importers, and distributors of UK consumer smart productsAny manufacturer of a UK consumer smart product, entity that markets a product manufactured by another entity under that entity’s name or trademark, importer of UK consumer smart products, and distributor of UK consumer smart productsA fine of at least £10 million or 4% of revenue (whichever is higher), alongside possible public disclosure orders, product recalls or bans, suspension of operations, and loss of licensesRegulation 2023/2841: Regulation on Cybersecurity Measures for EU InstitutionsEUEstablishes common cybersecurity measures across EU institutionsEU institutions, offices, and agenciesNo fines, but institutions could face suspension of operations, warnings, and recommendationsRegulation 2024/482: Commission Implementing Regulation on European Common Criteria-based Cybersecurity Certification SchemeEUEstablishes rules and obligations for manufacturers and certification entities involved in the EU Common Criteria (introduced in the EU Cybersecurity Act)Manufacturers, importers, and distributors of ICT products subject to or pursuing EUCC certification, whether required by EU law or chosen voluntarilyFines are set by EU Member States, while operational penalties include public disclosure orders, product recalls or bans, and suspension of operationsTelecommunications (Security) Act (TSA)UKEnforces legal obligations on telecom providers in the UK to safeguard their networksPublic electronic communication network providers, public electronic communications service providers, suppliers of telecommunication equipment, and managed service providers for telecommunication networksA fine of at least £10 million or 10% of revenue (whichever is higher), alongside possible public disclosure orders, product recalls or bans, suspension of operations, loss of licenses, and enforcement notices