Cybersecurity regulations face ‘uphill battle’ after Chevron ruling

The Supreme Court’s overturning of the Chevron doctrine threatens the legal basis for the Biden administration’s efforts to tighten cybersecurity regulations, making existing and proposed rules more vulnerable to court challenges. Examples include the EPA’s withdrawn bid to impose cybersecurity audits under the Safe Drinking Water Act, CISA’s interpretation-heavy CIRCIA incident-reporting rulemaking, the SEC’s SolarWinds enforcement under the 1934 Act, and the FTC’s push to regulate commercial surveillance and data security—each relying on statutory interpretations that may face steeper judicial scrutiny.