Analyze why private market incentives structurally underinvest in critical infrastructure cybersecurity, evaluate the effectiveness of mandated minimum standards as a corrective mechanism, and identify the optimal policy mix between regulation, liability restructuring, and public investment.

Analysis of cybersecurity incident data from critical infrastructure sectors (energy, water, healthcare, finance) 2015-2024, comparative evaluation of regulatory regimes (US NERC CIP for energy, EU NIS2 Directive, Australia SOCI Act), and economic modeling of externality structures that produce underinvestment.

Critical infrastructure cybersecurity exhibits a classic negative externality structure: the costs of a successful attack fall primarily on the public (service disruption, cascading failures, national security consequences) while the costs of prevention fall primarily on the private operator.

This creates systematic underinvestment -- the operator internalizes prevention costs but externalizes breach consequences. 3B) is 100-500x higher. Market incentives cannot resolve this gap. Three regulatory approaches have been attempted.

(1) Mandated minimum standards (NERC CIP model): effective at raising the floor but creates compliance theater -- operators optimize for audit passage rather than actual resilience. Post-audit breach rates are not significantly lower than pre-mandate baselines in sectors where audits are infrequent.

(2) Liability restructuring: making operators financially liable for breach consequences internalizes the externality but produces insurance market concentration rather than genuine security investment -- operators buy coverage rather than build resilience.

(3) Public-private mandatory information sharing (EU NIS2 model): most promising mechanism -- requires operators to report incidents within 24 hours, creating a collective threat intelligence pool that raises the entire sector defense posture. Early NIS2 implementation data shows 31% faster threat detection across reporting entities.

The synthesis finding is that no single mechanism is sufficient.

The optimal policy stack combines: mandatory minimum standards as a floor (with outcome-based rather than compliance-based audit criteria), liability caps that make insurance economically rational without replacing investment incentives, and mandatory information sharing that generates collective defense without exposing competitive intelligence.

The missing element in all current frameworks is public investment in sector-wide threat intelligence infrastructure -- treating cybersecurity as a public good in the same way physical infrastructure security is treated.