Biden’s cybersecurity legacy: ‘a big shift’ to private sector responsibility

### Executive summary The article reviews a significant shift in U.S. cybersecurity policy under the Biden administration toward placing greater responsibility for security on technology vendors and critical infrastructure operators, driven by executive orders, agency rules (for pipelines, rail, and other sectors), and legislation like the cyber reporting law CIRCIA. It outlines initiatives such as CISA’s Secure by Design and voluntary secure-software efforts, highlights industry pushback and legal obstacles (including a blocked EPA water rule and the post-Chevron regulatory environment), and notes that political outcomes and court decisions will shape how far and how fast these regulatory changes proceed.