Cybersecurity of and through regulatory sandboxes: an analytical approach

The present work presents an analysis for advancing the understanding of regulatory sandboxes along two interconnected dimensions. First, it proposes a four-fold classification scheme that categorizes sandboxes based on their primary regulatory objective and risk scope: i.e., sector-based, technology-based, domain-based, and rights-based frameworks. This classification moves beyond existing categorizations to capture the diverse purposes and governance structures that characterize regulatory sandbox implementations. Second, it introduces a critical distinction between cybersecurity of sandboxes (such as the security of data and infrastructure, including requirements that ensure operational reliability) and cybersecurity through sandboxes (the evaluation and testing of cybersecurity compliance within these controlled environments). This research aims to contribute to the emerging scholarship on experimental regulation through regulatory sandboxes, offering practical insights to properly integrate cybersecurity measures in sandbox functioning.