Legal Design and Cyber Resilience: A Comparative Study of Cybersecurity Frameworks for Critical Infrastructure in Five Jurisdictions

Cyber threats targeting critical infrastructure, particularly Operational Technology (OT) and Industrial Control Systems (ICS), have escalated globally in both frequency and severity, prompting nations to implement legal frameworks mandating risk management and incident reporting. This study provides a comparative analysis of cybersecurity regulations across five jurisdictions: the European Union, United States, Australia, Singapore, and Indonesia. It aims to evaluate how legal design, reporting obligations, and institutional coordination influence cyber risk outcomes. Using panel data from 2020 to 2025, this research employs Difference-in-Differences and fixed effects models to assess the relationship between regulatory adoption and indicators such as OT ransomware activity and ICS threat block rates. Legal variables include the implementation status of NIS2, CIRCIA, SOCI/SLACIP, the Cybersecurity Act (SG), and Perpres 82/2022 (ID). Outcome data are drawn from Dragos and Kaspersky ICS-CERT reports. The results indicate that jurisdictions with rapid reporting mandates (12–24h), standardized frameworks (NIST CSF), and strong institutional oversight demonstrate improved cyber resilience. For example, ransomware trends decline in Australia and the EU post-regulation, while malicious block rates increase in Singapore and Indonesia. However, compliance burdens and fragmented oversight reduce regulatory efficacy, especially in less coordinated systems like the US. The study concludes that successful cybersecurity governance depends on the alignment of legal mandates, operational feasibility, and institutional capability. For developing countries like Indonesia, enhancing cross-sector CSIRT capacity, aligning with global standards, and streamlining regulatory requirements are critical for improving national cyber resilience.