A working experimentation model for cyber resilience regulatory sandboxes

In today's volatile and highly dynamic global environment, regulators and stakeholders encounter significant challenges in addressing cyber risk, particularly considering rapidly evolving digital technologies and of the lack of instruments to anticipate specific scenarios in controlled environments. This paper first examines the potential of cyber risk mitigation through regulatory experimentation, in the context of regulatory sandboxes. Through the analysis of 43 relevant use cases, the research focuses on the evaluation of the role of risk management measures within regulatory sandboxes. Against this backdrop, the article then proposes a working experimentation model for cyber resilience – titled the “3PS model” and comprising Products, Systems, Processes and Services as components, which could be used for Procedural or Security functions. This working experimentation model could serve as a foundation for future real-world applications (e.g., in the field of cyber resilience regulatory sandboxes).