Brandon Pugh, the policy director of the R Street Institute’s cybersecurity and emerging threats team, said that the EO “is a step in the right direction” to protect Americans’ data from exploitation from countries of concern but that additional action will be needed. “The key to success will be getting the implementation and accompanying regulations right to ensure trade, innovation, ordinary business practices, and existing legal frameworks like data flow agreements are not unduly impacted,” regarding the security requirements established by CISA, how exemptions and exceptions are addressed and streamlining the process for licenses and advisory opinions.