A First Look at Governments' Enterprise Security Guidance

Explore the first systematic analysis of government cybersecurity guidance for enterprises in this conference presentation from USENIX Security '25. Examine how researchers from Stanford University, Fisk University, University of Chicago, and FS-ISAC conducted a comprehensive study of cybersecurity advice published by government agencies across 41 countries to help organizations combat enterprise breaches. Learn about the methodology used to curate and analyze prominent guidance documents, including the development of a tree-based taxonomy and quantitative comparison metric for detailed analysis. Discover findings about the availability, coverage, and consistency of cybersecurity advice across different nations, with particular focus on "essential" enterprise best practice documents from ten countries. Understand the research team's key discovery that reveals a surprising lack of consensus among government frameworks—even among close allies—regarding recommended security measures and guidance presentation methods. Gain insights into the implications of these inconsistencies for organizations seeking to implement government-recommended cybersecurity practices and the broader challenges facing international cybersecurity standardization efforts.