Cyber Security Infrastructure: Laws, Threats, and Gaps

Cybersecurity infrastructure in the United States is the overlapping system of federal agencies, laws, technical frameworks, and public-private partnerships that protects the digital and physical systems the country depends on, from power grids and water plants to telecom networks and financial markets. The Cybersecurity and Infrastructure Security Agency (CISA) sits at the center of that system as the national coordinator, but the work is shared with sector-specific agencies, private operators, and international partners.1CISA. About CISA The picture right now is a paradox: threats from Chinese and Iranian state-sponsored groups are intensifying, new reporting rules are still being written, and the lead agency is facing proposed cuts of roughly $495 million and more than 1,000 positions.2DHS. CISA FY2026 Congressional Budget Justification

What Counts as Critical Infrastructure

Federal policy identifies 16 critical infrastructure sectors whose disruption would have a debilitating effect on national security, the economy, or public health and safety.3CISA. Critical Infrastructure Sectors They are:

  • Energy (electricity, oil, natural gas)
  • Water and Wastewater Systems
  • Communications
  • Transportation Systems (aviation, rail, maritime, road)
  • Healthcare and Public Health
  • Financial Services
  • Information Technology
  • Defense Industrial Base
  • Chemical
  • Commercial Facilities
  • Critical Manufacturing
  • Dams
  • Emergency Services
  • Food and Agriculture
  • Government Facilities
  • Nuclear Reactors, Materials, and Waste

Each sector has at least one designated Sector Risk Management Agency (SRMA), which acts as the day-to-day federal interface with the private companies and government entities that actually own and operate the assets.4The American Presidency Project. National Security Memorandum on Critical Infrastructure Security and Resilience

Who Coordinates the Federal Response

CISA leads national coordination of critical infrastructure security and resilience, with a mission spanning cybersecurity, infrastructure security, and emergency communications.1CISA. About CISA The policy architecture around it rests on Presidential Policy Directive 21 and its successor, National Security Memorandum 22, issued on April 30, 2024. NSM-22 requires each SRMA to name an accountable senior official, lead sector-specific risk assessments, facilitate information sharing, and support incident management. A Federal Senior Leadership Council, co-chaired by the CISA director and a rotating SRMA representative, coordinates priorities across sectors.4The American Presidency Project. National Security Memorandum on Critical Infrastructure Security and Resilience

How well that framework actually works is contested. The Cyberspace Solarium Commission described SRMA performance as “inconsistent at best and wholly deficient at worst,” citing uneven resourcing and stale policy documents.5Cyberspace Solarium Commission. Revising Public-Private Collaboration to Protect U.S. Critical Infrastructure Some sector-specific plans have not been updated in over a decade.6Sen. Warner. Warner Introduces Bill to Update Cybersecurity Plans and Defend Against Emerging AI Threats

The Rules Operators Must Follow

CIRCIA: Reporting Cyber Incidents to CISA

The Cyber Incident Reporting for Critical Infrastructure Act, passed in March 2022, creates the first broad federal mandate for critical infrastructure operators to report cyber incidents and ransom payments to CISA. Covered entities will have to report significant cyber incidents within 72 hours of reasonably believing one has occurred, and report ransomware payments within 24 hours of making them. CISA estimates the rules will cover more than 300,000 entities across all 16 sectors, with coverage determined by sector-based criteria and size thresholds tied to Small Business Administration standards.7CISA. Cyber Incident Reporting for Critical Infrastructure Act of 2022

The rules are not yet in effect. CISA published a Notice of Proposed Rulemaking on April 4, 2024, and had targeted a final rule for May 2026, but a mid-2026 lapse in DHS appropriations forced the agency to suspend planned town halls and acknowledge that “continued delays associated with federal appropriations lapses will likely result in a delay to the issuance of the final rule.” Until the final rule takes effect, there is no mandatory reporting requirement under CIRCIA; CISA encourages voluntary reporting.7CISA. Cyber Incident Reporting for Critical Infrastructure Act of 2022

SEC Cybersecurity Disclosure Rules

Public companies face parallel obligations under rules the Securities and Exchange Commission adopted in July 2023. Registrants must disclose any cybersecurity incident they determine to be material via Form 8-K within four business days of that materiality determination, describing the nature, scope, timing, and material impact of the incident. Annual reports on Form 10-K must describe the company’s processes for assessing and managing cybersecurity risks, and the board’s oversight role. The only authorized delay is a written request from the U.S. Attorney General to protect national security or public safety.8SEC. SEC Adopts Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies

TSA Pipeline Security Directives

Pipeline operators moved from voluntary industry guidelines to binding cybersecurity requirements after the May 2021 Colonial Pipeline ransomware attack, which shut down the largest refined-products pipeline on the East Coast for roughly five days and triggered fuel shortages across the Southeast.9Georgetown Environmental Law Review. Cybersecurity Policy Responses to the Colonial Pipeline Ransomware Attack The Transportation Security Administration now maintains two Security Directives for critical pipeline operators. SD Pipeline-2021-01G, effective January 16, 2026, requires operators to designate a cybersecurity coordinator accessible to TSA and CISA around the clock, report incidents to CISA within 72 hours, and conduct vulnerability assessments.10TSA. Security Directive Pipeline-2021-01G Companion directive SD Pipeline-2021-02F mandates a performance-based defense-in-depth implementation plan, including network segmentation, multi-factor authentication, continuous monitoring, and patch management prioritizing CISA’s Known Exploited Vulnerabilities Catalog.11TSA. Security Directive Pipeline-2021-02F Both are renewed annually.

The Colonial attack also produced the Bipartisan Infrastructure Law’s $1 billion State and Local Cybersecurity Grant Program, a Cyber Response and Recovery Fund, and Executive Order 14,028 on federal supply chain security.9Georgetown Environmental Law Review. Cybersecurity Policy Responses to the Colonial Pipeline Ransomware Attack

The Threats Driving Policy Today

China: Volt Typhoon and Salt Typhoon

The most consequential threat comes from Chinese state-sponsored groups. In February 2024, CISA, the NSA, and the FBI issued a joint advisory confirming that a group called Volt Typhoon had compromised IT networks in the communications, energy, transportation, and water sectors, maintaining persistent access in some cases for at least five years. The advisory assessed with high confidence that Volt Typhoon was pre-positioning to enable disruptive or destructive cyberattacks on operational technology during a future crisis or military conflict — a pattern inconsistent with traditional espionage.12CISA. PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure

Volt Typhoon’s signature technique is “living off the land,” using native system tools like PowerShell and legitimate administrator credentials rather than custom malware, which lets the actors blend in with normal network activity.13NSA. NSA and Partners Spotlight PRC Targeting of U.S. Critical Infrastructure Initial access typically comes through exploiting known vulnerabilities in public-facing network appliances from vendors like Fortinet, Ivanti, and Cisco.12CISA. PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure

A separate group, Salt Typhoon, conducted a massive breach of at least eight U.S. telecommunications providers disclosed in late 2024, stealing customer call data and law enforcement surveillance request data.14Center for Strategic and International Studies. Significant Cyber Incidents A September 2025 joint advisory attributed ongoing global telecommunications intrusions to entities linked to Salt Typhoon, with activity dating back to at least 2021.15CISA. Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide

Iran: Targeting Industrial Control Systems

Iranian-affiliated actors have concentrated on operational technology. In April 2026, CISA, the FBI, the NSA, the EPA, and the Department of Energy warned that Iranian APT actors had been targeting internet-exposed Rockwell Automation programmable logic controllers in water, energy, and government facilities since at least March 2026, manipulating industrial control system files and disrupting operations. That followed a 2023 campaign by the IRGC-affiliated “CyberAv3ngers” group, which compromised at least 75 Unitronics PLCs in U.S. water and wastewater systems.16CISA. Iranian-Affiliated APT Actors Targeting OT Devices

Other Recent Incidents

Beyond nation-state campaigns, attackers in 2024 and 2025 compromised the Office of the Comptroller of the Currency (spying on roughly 103 bank regulators’ emails for over a year), the U.S. Treasury Department (through a third-party vendor breach linked to Chinese hackers), and the Congressional Budget Office. In November 2025, the INC ransomware gang compromised the CodeRED emergency alert system, halting alerts across multiple states.14Center for Strategic and International Studies. Significant Cyber Incidents

How the Defense Is Built

Zero Trust Architecture

The dominant strategic framework for protecting cyber infrastructure is zero trust, which assumes any network may already be compromised and requires continuous verification of every user, device, and connection. NIST Special Publication 800-207 defines zero trust as a strategy in which trust is never granted implicitly, access is enforced on a per-session basis using least-privilege principles, and dynamic policies evaluate identity, device state, and behavioral attributes before granting access.17NIST. Zero Trust Architecture (SP 800-207) CISA released version 1.0 of its Zero Trust Maturity Model in September 2021 as a roadmap for federal agencies, emphasizing phishing-resistant multi-factor authentication, microsegmentation, and encrypted DNS.18CISA. Zero Trust

NIST Cybersecurity Framework 2.0

Released on February 26, 2024, the NIST Cybersecurity Framework 2.0 is a foundational resource for organizations of all sizes and sectors, no longer limited to critical infrastructure as earlier versions were. The update adds a sixth core function, GOVERN, to the existing five (Identify, Protect, Detect, Respond, Recover), reflecting the growing importance of cybersecurity governance and supply chain risk management at the board and executive level. Organizations use it to build “Current” and “Target” profiles of their posture and assess maturity across four tiers, from Partial to Adaptive. The framework is voluntary, but it can be adopted or mandated by government policy and maps to other global standards.19NIST. NIST Cybersecurity Framework 2.0

The Joint Cyber Defense Collaborative

CISA’s Joint Cyber Defense Collaborative, established in 2021, is the agency’s primary mechanism for working with the private sector on defense. The JCDC brings together companies, other government agencies, and foreign governments to plan for future threats, analyze ongoing attack campaigns, publish defensive guidance, coordinate government responses to major incidents, and lead risk assessments for critical infrastructure sectors. The unit relies heavily on contractor support. In July 2025, the JCDC lost the vast majority of its contract workforce when a contract with ICF expired, dropping from over 100 contractors to 10.20Cybersecurity Dive. CISA Joint Cyber Defense Collaborative Contract Lapse

Where the System Is Weak Right Now

Proposed Cuts to CISA

The second Trump administration’s fiscal year 2026 budget request sought a total reduction of roughly $495 million at CISA, bringing the agency from about $2.87 billion to about $2.38 billion. The proposal would eliminate more than 1,000 positions, cutting the workforce from 3,732 to 2,649, and would zero out research and development funding.2DHS. CISA FY2026 Congressional Budget Justification

Division-by-division, the cuts run deep. The Cybersecurity Division faces a $216 million reduction and the loss of 204 positions. The National Risk Management Center would lose 73% of its funding and 35 positions. The Stakeholder Engagement Division would see a 62% cut, and the Integrated Operations Division would lose 327 positions.21Cybersecurity Dive. CISA Trump 2026 Budget Proposal Program eliminations include CISA’s election security program (14 positions and roughly $37–40 million), the Cyber Defense Education and Training program ($45.4 million), and the Chemical Security Anti-Terrorism Standards program (224 positions and $40 million).22Federal News Network. DHS Budget Request Would Cut CISA Staff by 1,000 Positions The administration characterized some previous CISA activities as “bureaucratic overreach and politicization,” citing the agency’s role in debunking 2020 election fraud claims and its work on disinformation.23Nextgov. CISA Projected to Lose Third of Its Workforce Under Trump 2026 Budget

The House Appropriations Committee’s homeland security subcommittee offered a partial reprieve, approving $2.7 billion for CISA in its fiscal 2026 bill — $134 million below the current year but well above the administration’s request. That bill earmarked $808.6 million for cybersecurity defense technology and services and $758.2 million for cyber operations including vulnerability management and threat hunting.24Federal News Network. House Lawmakers CISA Budget Reprieve Comes With Questions Congress retains the final say.

Leadership Vacuum

CISA has lacked a Senate-confirmed director throughout the second Trump administration. President Trump nominated Sean Plankey in March 2025; the Senate Homeland Security and Governmental Affairs Committee advanced his nomination in July 2025.25U.S. Congress. Nomination PN26-38 – Sean Plankey The nomination stalled after holds by Senator Rick Scott and others. Trump re-nominated Plankey in January 2026, but Plankey withdrew on April 22, 2026, after 13 months, writing that “it has become clear the Senate will not confirm me.” The agency is currently led by Acting Director Nick Andersen.26Federal News Network. Plankey Withdraws as CISA Nominee

State and Local Governments

The State and Local Cybersecurity Grant Program is the federal government’s main tool for strengthening cybersecurity below the federal level. The $1 billion program, distributed over four years and jointly administered by CISA and FEMA, requires states to distribute at least 80% of funds to local governments, with a minimum of 25% going to rural areas. DHS announced $91.7 million for fiscal 2025, following over $400 million in fiscal 2023 and over $300 million in fiscal 2024.27CISA. State and Local Cybersecurity Grant Program

Authorization currently extends only through the end of fiscal 2026. An April 2026 report from the Information Technology and Innovation Foundation described state and local cybersecurity as “fragmented, underfunded, and unprepared.” A shift in DHS fiscal 2025 guidance now prohibits federal grant funds from covering memberships for the Multi-State Information Sharing and Analysis Center, forcing the Center for Internet Security to move to a subscription model for threat intelligence and incident response services that were previously free to local governments.28ITIF. Improving State and Local Government Cybersecurity

The Water Sector Gap

Water and wastewater systems illustrate how hard it is to impose cybersecurity requirements on fragmented, locally operated infrastructure. In March 2023, the EPA attempted to use existing legal authority to require mandatory cybersecurity assessments at drinking water systems. A coalition of states and water associations challenged the rule, and in July 2023 the U.S. Court of Appeals for the Eighth Circuit blocked it in State of Missouri, et al v. EPA, et al. The EPA withdrew the rule in October 2023 and now relies on voluntary agreements, though the agency announced in May 2024 that it would step up enforcement. The EPA has identified limitations in its existing legal authority and provided technical assistance to Congress on potential updates to the Safe Drinking Water Act.29GAO. Critical Infrastructure Protection: EPA Needs a Strategy to Address Cybersecurity Risks to Water Systems

What’s Coming

New Legislation

On June 10, 2026, Senator Mark Warner introduced the Combat Emerging Threats to Critical Infrastructure Act of 2026. The bill would require CISA to update cybersecurity plans for all 16 critical infrastructure sectors within nine months, mandate risk profiles for technology-facilitated threats such as AI-enhanced cyberattacks and quantum-based attacks on cryptography, and establish a two-year update cycle for sector-specific plans in coordination with SRMAs. The bill was prompted in part by the recognition that some sector-specific plans have not been updated in over a decade.6Sen. Warner. Warner Introduces Bill to Update Cybersecurity Plans and Defend Against Emerging AI Threats

How the EU Approach Differs

For context on where the U.S. sits, the European Union has taken a more prescriptive path. The NIS2 Directive, in force since January 2023 and required to be transposed into national law by October 17, 2024, covers 18 critical sectors and applies to medium-sized and large entities. It imposes mandatory risk-management measures, holds top management personally accountable, and requires incident notification in three stages: an early warning within 24 hours, an initial assessment within 72 hours, and a final report within one month. Administrative fines reach up to €10 million or 2% of global annual turnover, and management can face temporary bans for governance failures. Implementation has varied, and the Commission has launched infringement proceedings against member states that missed the deadline.30European Commission. NIS2 Directive The EU’s Cyber Resilience Act, in force since December 10, 2024, adds cybersecurity requirements for hardware and software products with digital elements, with reporting obligations for actively exploited vulnerabilities starting in September 2026 and full compliance required by December 2027.31European Commission. Cyber Resilience Act

Emerging Risks

The World Economic Forum’s Global Cybersecurity Outlook 2026 found that 94% of cybersecurity leaders consider AI the most significant driver of change in the field, and 87% identified AI-related vulnerabilities as the fastest-growing risk in 2025. Confidence in national ability to respond to major cyber incidents targeting critical infrastructure is falling, with 31% of respondents reporting low confidence, up from 26% the previous year.32World Economic Forum. Global Cybersecurity Outlook 2026 The convergence of operational technology with information technology continues to widen the attack surface, particularly in utilities. Quantum computing is not yet an immediate concern, but nearly half of organizations have not begun implementing quantum-resistant security measures.33PwC. 2026 Cybersecurity Outlook

The tension at the heart of U.S. policy is now sharply defined. State-sponsored actors are pre-positioning in critical networks, AI is lowering the barrier for attackers, and ransomware remains endemic, while the lead federal agency is losing staff, budget, leadership, and key programs. How Congress resolves that tension in the coming appropriations cycle will shape the country’s cyber resilience for years.