Cybersecurity Governance for Critical Infrastructure in Finance and Energy: Bridging the Compliance–Readiness Gap between Saudi Arabia and the United States (OT/IoT, AI, and Post-Quantum Cryptography)

Abstract

This dissertation critically examines the cybersecurity governance of critical infrastructure in Saudi Arabia and the United States, focusing on the finance and energy sectors. It explores how regulatory compliance translates into operational readiness against emerging risks from Operational Technology (OT), Internet of Things (IoT), Artificial Intelligence (AI), and post-quantum cryptography (PQC).

The research applies Digital Security Risk Management (DSRM), the Regulatory Governance and Collective Accountability (RGCA) model, and Calo’s framework on privacy harm to assess the effectiveness of each jurisdiction’s cybersecurity architecture. Through a comparative legal and policy analysis, it identifies systemic gaps that hinder resilience and proposes a governance roadmap for Saudi Arabia to strengthen sectoral coordination, enforce quantum-aware breach disclosure, and institutionalize PQC migration.

Ultimately, the study argues that bridging the compliance–readiness gap requires integrated oversight between legal and technical domains, proactive threat modelling, and adaptive regulatory mechanisms that align with technological evolution and interdependent risk environments.