The systems most Americans never think about until they stop working are getting a full month of attention in Washington. The Cybersecurity and Infrastructure Security Agency, known as CISA, has launched its 2026 Critical Infrastructure Security and Resilience Month campaign, running throughout November under the theme “Resolve to be Resilient.” The message is deliberately practical rather than dramatic: assume a disruption will come, know what matters most, and be ready to keep operating in a degraded state and recover quickly afterwards.
The timing is no accident. November brings winter storms, a busy holiday travel and shopping season, and a threat landscape that now spans physical damage, cyber intrusion and the knock-on effects of one failed system on many others. CISA, which serves as the national coordinator for critical infrastructure security and resilience, is using the month to push owners and operators, state and local governments, and the private companies that run most of the country’s essential services toward the same short checklist.
That focus on preparation over panic is the thread running through the whole campaign. Resilience, in CISA’s framing, is not a product that can be bought or a single security control that can be installed. It is work done in advance: mapping what a system depends on, deciding which risks deserve attention first, writing plans that can actually be followed under stress, and then measuring whether those plans improve.
What Critical Infrastructure Security and Resilience Month 2026 is asking organisations to do
At its simplest, the month asks every organisation that runs an essential service to answer four questions. First, what is your infrastructure, and what does it depend on? Second, which risks matter most to that infrastructure? Third, what is your actionable plan for responding and recovering? Fourth, how will you measure progress and keep the plan current? CISA presents those four steps as a cycle rather than a one-off exercise, because dependencies change, threats evolve, and a plan written for last year’s risks may miss this year’s.
The first step is often the hardest, and the most revealing. A water treatment plant, for example, does not only depend on its own pumps and filters. It depends on electricity, on chemicals delivered by road or rail, on communications networks for remote monitoring, and on staff who can reach the site in a storm. A hospital depends on power, water, medical gases, supply deliveries and digital records systems. When planners trace those chains honestly, they usually find dependencies they had not fully considered, and single points of failure that deserve a backup, a workaround or at least a decision made in advance rather than in a crisis.
Prioritising risk is the second discipline, and it forces a choice. No organisation can harden everything at once, so CISA urges leaders to rank the risks that would cause the most harm if they materialised, and to spend first where the return is greatest. That may mean patching the most exposed control system, rehearsing a manual fallback for a key process, or simply making sure that backup power, spare parts and contact lists are where people expect them to be. The point is to move from a long list of worries to a short list of actions with owners and deadlines.
The four practices behind the Resolve to be Resilient theme
CISA’s four practices sound simple, and that is intentional. Know your infrastructure and dependencies. Prioritise the risks that matter most. Make actionable plans. Measure progress so you can respond and recover quickly when something goes wrong. Each practice supports the next. A plan built on an incomplete map of dependencies will fail at the first unexpected link. A risk ranking without a plan is only a warning. And a plan that is never measured or exercised quietly decays as staff change, systems are upgraded and suppliers shift.
Measuring progress deserves particular emphasis because it is the step most often skipped. CISA encourages organisations to track whether exercises actually happened, whether lessons from those exercises changed the plan, and whether recovery times improved. A tabletop exercise that reveals a missing phone number or a backup that no one knows how to start has done its job, provided someone fixes the gap afterwards. The campaign’s toolkit, with graphics and plain-language text, is designed to make that kind of follow-through easier to communicate inside an organisation, from the control room to the boardroom.
The theme itself, “Resolve to be Resilient,” is a deliberate shift in language. Older security campaigns often stressed keeping attackers out. This one stresses what happens after an incident begins, whether the cause is a cyber attack, a storm, an equipment failure or a physical threat. Can the service keep running, even at reduced capacity? Can staff switch to a manual process? How fast can normal service return, and what will customers and partner organisations be told in the meantime? Those are resilience questions, and they apply even when prevention has worked as well as it possibly can.
Why operational technology security is now central to the campaign
One of the sharpest focuses of the 2026 campaign is operational technology, often shortened to OT. These are the computers and control systems that open valves, regulate pressure, manage electrical substations and run factory lines. Unlike office IT systems, OT systems were often built to last for decades, were not originally designed to connect to wider networks, and cannot simply be taken offline for a routine update without interrupting a service people depend on.
That combination makes OT security a distinct discipline. Patching must be planned around operations. Network connections must be mapped and, where possible, segmented so that a compromise in an office network does not automatically reach a control network. And operators need ways to spot unusual behaviour in systems that normally follow predictable patterns. CISA’s campaign urges owners to treat OT security, operational continuity and recovery planning together, rather than as three separate projects owned by three separate teams.
The stakes are easy to picture without exaggeration. If a control system is disrupted, the effect is not only a data breach or a leaked file. It can be a treatment process that must be run by hand, a distribution network that must be managed without its usual telemetry, or a service that must be rationed while engineers restore control. Recovery planning therefore includes practical questions: what manual procedures exist, who is trained in them, what spare equipment is available, and how long can the manual workaround safely sustain service? Organisations that can answer those questions before an incident are in a far stronger position than those discovering them during one.
Sixteen sectors, one chain of dependencies
The United States divides its critical infrastructure into sixteen sectors, spanning energy, water, healthcare, transportation, communications, financial services, food and agriculture, emergency services and others. The number matters less than the interconnection it represents. A disruption in one sector rarely stays there. A power outage affects water pumping and communications. A communications failure affects transport scheduling and emergency response. A fuel supply problem affects deliveries to hospitals, grocery stores and power plants.
CISA’s role as national coordinator is to work across those sector boundaries, alongside sector risk management agencies, state and local governments, tribal and territorial partners, and private owners. Much of the country’s critical infrastructure is privately owned and operated, which means resilience cannot be imposed from Washington alone. It has to be built through shared guidance, joint exercises and a common language for risk, so that a utility in one state and a supplier in another can plan against the same assumptions.
That shared approach also explains why the campaign stresses continuity alongside security. A perfectly secured system that cannot recover quickly still leaves people without a service. A resilient system, by contrast, may suffer damage and still keep its most essential functions running, restore the rest in a planned order, and learn from the incident. The distinction is subtle but important, and it is why the campaign pairs security advice with recovery planning rather than treating recovery as an afterthought.
Water systems: where the EPA’s part of the month fits in
Drinking water and wastewater systems illustrate the campaign’s practical side. The Environmental Protection Agency is marking the month with guidance, tools and technical assistance aimed at helping water systems protect operations during major disasters, while also building resilience against natural hazards, physical security threats, contamination events and cyberattacks. For a sector made up of thousands of systems of very different sizes, that kind of tailored help matters: a large city utility and a small rural system face the same categories of risk but have very different staff and budgets.
The EPA’s resources include tools for assessing vulnerability, guides for resilient strategies, and cybersecurity support ranging from assessments and training to incident response planning. The underlying message matches CISA’s: identify the hazards that could interrupt service, understand which assets are most critical, and put practical protections and recovery steps in place before they are needed. A water system that has mapped its power dependencies, secured its remote access and rehearsed its emergency response is better placed to keep safe water flowing when a storm, a cyber incident or an equipment failure strikes.
The water example also shows why resilience month is not only a cybersecurity story. Floods, ice storms, wildfires and heatwaves can damage physical infrastructure just as surely as malware can disrupt a control system. Planning therefore has to cover both, and exercises have to test both. A plan that assumes power will always be available, or that a single road will always be open for chemical deliveries, is a plan with a hidden assumption waiting to be exposed.
What resilience means for ordinary Americans
For people who do not run infrastructure, the campaign may seem distant, but its effects are close to home. When resilience planning works, a storm causes a shorter outage, a cyber incident causes a controlled disruption rather than a cascading failure, and essential services return in a predictable order with clear public information. When it does not work, the same incident can mean longer waits, scarcer information and harder choices for hospitals, emergency services and households.
There are also steps households and small businesses can take that mirror the campaign’s four practices on a smaller scale. Knowing dependencies might mean knowing which services a home or business truly cannot do without, and what happens if power, water, internet or a key supplier is interrupted. Prioritising risk might mean preparing for the most likely local hazard first, whether that is a winter storm, a flood or an extended outage. An actionable plan might be as simple as backup communications, stored water, charged devices and a written list of contacts and manual workarounds. Measuring progress might mean testing that plan once, finding the gap, and fixing it.
None of that replaces the work of infrastructure operators, and CISA does not present it as doing so. But a public that understands why a service is being restored in a particular order, and what to expect while restoration continues, is easier to keep informed and safer during the disruption. Clear communication is itself part of recovery, and it is one of the quieter benefits of planning done in advance.
What happens after November, and why the month still matters
A month-long campaign always raises the same question: what changes on December 1? CISA’s answer, implicit in its four practices, is that the month is a prompt, not a finish line. Organisations are encouraged to use November to start or refresh their mapping, planning and exercising, and then to keep that cycle going through the year. Risks do not observe a calendar, and the geopolitical shifts, rapid advances in artificial intelligence and evolving threats that CISA cites as the backdrop to this year’s campaign will still be present in winter and spring.
The campaign also sits alongside a wider policy conversation about infrastructure protection, including the Cybersecurity Information Sharing Act renewal debate, which concerns information sharing law rather than this month’s resilience practices. Keeping those threads distinct matters: sharing threat information helps organisations defend themselves, while resilience planning helps them keep operating and recover when defence alone is not enough. Both are needed, and neither substitutes for the other.
For readers, the most useful test of the campaign will be mundane rather than dramatic. Did a local utility publish clearer outage information? Did a hospital or water system complete an exercise and change a procedure as a result? Did a small operator find a dependency it had missed and fix it before a storm found it first? Those are the kinds of quiet improvements that resilience month is designed to produce, and they are usually only noticed when the alternative, a longer and messier disruption, does not happen.
As November continues, CISA is expected to keep publishing resources and sector guidance through the month. The central invitation remains the same from the first week to the last: resolve to be resilient now, while there is time to plan, so that recovery later is faster, calmer and shorter for everyone who depends on the service.
Sources
USN reviewed reporting from multiple outlets for this story. Read more from Industrial Cyber, U.S. EPA and Security Magazine.