Any additional regulation should incentivize organizations to increase their focus on cyberresilience and recovery. It’s not a matter of if, but when, an organization will be breached. The organizations that are cyberresilient will best be able to protect our privacy and our critical infrastructure.
Source: wiktionary