Therefore, any legislation has to wrestle with such topics as whether or how to mandate that businesses comply with security regulations, as well as what kind of incentives could nudge businesses to protect their networks on their own, such as incentives to break down barriers to sharing threat information between businesses and the federal government.