Cybersecurity Policy, Punctuated Equilibrium Theory, and the Biden Administration

This paper extends research on national cybersecurity policy by testing whether punctuated equilibrium theory (PET) effectively explains the Biden administration’s early positions on cyber and national security. Debate persists regarding whether and to what degree new administrations are able to chart new directions in major policy areas. Cybersecurity presents a particularly pressing challenge. Observers might expect a high degree of flexibility as strategic concepts, technical capabilities, and organization structures continue to evolve. Further, in the United States, transitions between presidential administrations and political parties represent major putative policy change. An earlier study found that, as predicted in PET, the Trump administration’s cybersecurity remained relatively constrained within existing policy frameworks. This paper extends that work by testing whether the Biden national cybersecurity policy conforms to predictions made by punctuated equilibrium theory. It evaluates the origins and content of the Biden administration’s major cybersecurity policies between early 2021 and mid-2022.