Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper critiques the current U.S. cyber policy's reliance on documentation as a proxy for safety in cyber-physical systems, highlighting its inadequacy in preventing kinetic harm. By analyzing a corpus of 292 critical infrastructure policy documents, the authors reveal that existing standards overly focus on administrative compliance during the Anticipate phase while neglecting the Withstand and Recover phases, which are misaligned with physical hazards. The authors propose a modernized standard of care that emphasizes hazard-specific traceability and structured assurance cases, advocating for federal policy changes to incentivize resilient infrastructure design.
Current cyber safety standards fail to protect against physical harm, revealing a critical gap in how we define and implement "reasonable care" in cyber-physical systems.
Current U.S. cyber policy, centered on security, often treats documentation of controls and incident reports as a proxy for safety in the built environment. This paper argues that such an approach is inadequate for cyber-physical systems, where digital failures can produce kinetic harm. We construct and code a corpus of critical infrastructure policy documents (N=292, 2000-2025) to examine how"reasonable care"is operationalized across the NIST SP 800-160 Vol.~2 resilience lifecycle. The resulting maps show that obligations are concentrated in the Anticipate phase and emphasize administrative compliance, while Withstand and Recover phases rely heavily on delegated references to IT-focused control catalogs that are poorly aligned with physics-based hazards. We identify three major disconnects: miscalibrated delegated standards, recovery defined as notification rather than engineered navigation, and uneven adaptation requirements across sectors. We then propose a modernized standard of care anchored in hazard-specific traceability, structured assurance cases, and cyber resiliency engineering. Finally, we recommend that federal policy pair these engineering obligations with targeted incentives so that resilient architectures for critical infrastructure become a viable business decision rather than an unfunded expectation.