The enforcement of certain norms on network participants – such as norms supporting information exchange and governing access to the network – is critical for ensuring the security of the network. While a public norm enforcer may be feasible in many situations, private norm enforcement may, and frequently does, complement or substitute for public enforcement. Private enforcement of cybersecurity is often subsidized, primarily in nonpecuniary manners (e.g., by exemption from antitrust laws). These subsidies may be necessary to capture the positive externalities of providing security to the network, but they also bias private parties' incentives and may result in the formation of inefficient security associations that are beneficial to their members only due to the subsidy. To mitigate this concern, subsidies should be awarded only to associations that are likely to be effective in enforcing norms on the network participants. This article offers a framework for assessing the likelihood that an association would become an effective norm enforcer.

Norms that are expensive to enforce are rarely enforced by newly formed private legal systems (PLSs) because the effectiveness of mechanisms used to secure compliance (e.g., the threat of exclusion) depends on the PLSs' ability to confer benefits on their members, and newly formed PLSs do not yet confer such benefits. Preexisting functionality inexpensively enhances a PLS's ability to enforce norms, and therefore most PLSs rely on preexisting institutions that already benefit members, typically by regulating norms that are not very costly to enforce.