For its military defense, the United States has an Army, Navy, Marine Corps and Air Force carrying out a clearly defined constitutional responsibility. For one of this era’s most clear and present dangers – cyberattacks – the forces are vast but diffused.
Since cyber threats began escalating in the 20th century, and particularly in the wake of the 2001 terrorist attacks, cybersecurity gained whole-of-government priority status. That extends to the intelligence community as well as U.S. Cyber Command; the FBI and law enforcement on federal, state and local levels; and because technological resources are heavily concentrated in the private sector, numerous associations, collaborations and centers of expertise contributing to what amounts to a vast public-private partnership for cyber defense.
The Cybersecurity and Infrastructure Security Agency Act of 2018 codified the placement of CISA, previously the Department of Homeland Security’s National Protection and Programs Directorate, at the top of the pyramid. It describes itself as “the national coordinator for critical infrastructure security and resilience [that] works with partners at every level to identify and manage risk to the cyber and physical infrastructure that Americans rely on every hour of every day.”
CISA Acting Director Andersen
But CISA has twisted in political winds. Late in 2020, then-director Christopher Krebs was fired after declaring, to the consternation of President Donald Trump, that the national election was “the most secure in American history.” Trump’s return to the White House in 2025 and efforts to cut federal bureaucracies affected CISA, which today is headed by Acting Director Nick Andersen.
The recently announced Super Intelligence Force is led by Director of National Intelligence Jay Clayton as “AI czar.” Under Secretary of Defense (or War) Emil Michael, Office of Personnel Management Director Scott Kupor, and Federal Trade Commission Chairman Andrew Ferguson were designated vice chairs.
Jen Easterly, an Army veteran and former Morgan Stanley head of firm resilience who headed CISA under President Joe Biden, wrote in an August 2, 2026, New York Times opinion article that federal -state coordination was weakening.
“Under Mr. Trump,” Easterly said, “the Department of Homeland Security has overseen significant personnel and budget cuts at the Cybersecurity and Infrastructure Security Agency, which still lacks a Senate-confirmed director. Federal support for the Multi-State Information Sharing and Analysis Center, which provides threat intelligence and other assistance to thousands of state and local governments, ended last year . . . And the Cybersecurity Information Sharing Act of 2015 – the legal framework that protects voluntary cyberthreat sharing between companies and government – is set to expire on September 30. [Editor’s note: Congress voted a limited extension of the law through January.]
“This is weakening America’s cyber defenses,” Easterly, now CEO of RSA Conference, continued, “and Washington should reverse course. The administration should rebuild [CISA’s] personnel and capabilities and nominate a qualified leader who understands that defending the nation’s infrastructure is a nonpartisan national security mission.”
Business does go on. In September, CISA conducted the 10th biannual Cyber Storm exercise for critical-infrastructure resilience, with 2,000 public- and private-sector participants.
To mark October as Cybersecurity Awareness Month, Acting Director Andersen stated that “CISA is prioritizing the security and resilience of critical infrastructure, and state, local, tribal, and territorial government, whose systems and services sustain us every day. This includes things like clean water, secure transportation, quality healthcare, secure financial transactions, rapid communications, and more.”
An August presidential memorandum directed formation of a National Coordination Center, with co-executive directors appointed by the attorney general and secretary of the Department of Homeland Security, to create and manage under federal contol “Cyber Surveillance Operations and Cyber Effects Operations against foreign Cyber-Enabled Transnational Criminal Organizations.”
Sharing of threat information and intelligence is central to the ISACs – Information Sharing and Analysis Centers – for individual sectors, including those that CISA designates as critical infrastructures.
Deborah Guild of PNC, FSSCC
The financial sector’s FS-ISAC, founded in 1999 and with 5,000 member firms worldwide, is considered a standout example. It is based in Reston, Virginia, and complemented by other U.S. membership organizations. These include the Cyber Risk Institute with its CRI Profile and other standards products; and the Financial Services Sector Coordinating Council (FSSCC), in a public-private partnership with the Treasury Department. The FSSCC describes the Financial and Banking Information Infrastructure Committee (FBIIC) as its “government counterpart.”
In August, Treasury announced the launch of the Quantum-Readiness Task Force, with a statement from FSSCC Chair Deborah Guild, head of Technology, PNC Financial Services Group: “Post-quantum cryptography readiness is no longer a future-proofing exercise – it is a present-day risk control. The transition requires organizations to prioritize critical systems and processes, manage dependencies across the financial ecosystem, and address implementation challenges. This task force sets the conditions for industry and government to align priorities and accelerate the transition to post-quantum cryptography.”
ABA Banking Journal reported then that the American Bankers Association is participating in a post-quantum task force formed by the FSSCC and FBIIC.
A newly prominent, diversified-membership forum is the Alliance for Critical Infrastructure (ACI), for “leading companies across communications, energy, financial services, information technology, transportation, and water systems to strengthen the physical and cyber resilience of America’s critical infrastructure.” It aims to “identify shared vulnerabilities, better understand critical dependencies, strengthen collective defenses, and prepare for emerging risks.”
"We are proud to support this important work," Jamie Dimon, JPMorgan Chase & Co. chairman and CEO, who is ACI’s board chair, told Reuters. “This group will help interface with [the government] and both give advice and take advice from the government.”
“Cybersecurity Is a Team Sport,” an October 1 online article by Todd Klessman, managing director, Financial Services Cyber & Technology of the Securities Industry and Financial Markets Association (SIFMA), underlined the importance of teamwork when cyber incidents occur.
SIFMA is responsible for the biennial Quantum Dawn exercises, which in November 2025 had nearly 1,000 participants from over 100 institutions working through a scenario involving a simultaneous Category 5 hurricane, undersea cable cut, financial market infrastructure outage, and zero-day cyberattack.
Todd Klessman
“How the sector coordinates amongst itself during an incident can make the difference between whether an incident is limited in scope or becomes systemic,” said Klessman, who joined SIFMA in January 2026 after 16 years with CISA. “During cyber incidents with the potential to cause market-wide impacts, SIFMA will activate our emergency crisis management command center and bring market participants together. By convening public and private representatives from across the sector to exchange information on incidents as they unfold, SIFMA helps facilitate a collective response from across the industry.”
Describing frontier AI as “the closest crocodile to the boat,” while the need to transition to post-quantum cryptography (PQC) is looming, Klessman added, “SIFMA and its members are supporting joint efforts being led by the [FSSCC and FBIIC] to enhance the sector’s quantum readiness through the development and publication of materials on topics such as PQC sector alignment, third-party and vendor readiness, and PQC for digital assets and emerging technologies.”
“Across financial services, the industry is working collaboratively to develop approaches to these emerging risks,” said a SIFMA LinkedIn post. “The Financial Services AI Risk Management Framework, developed by the Cyber Risk Institute and Financial Services Sector Coordinating Council with input from more than 100 financial institutions, provides a sector-specific approach to managing AI risk while enabling responsible innovation.
“FS-ISAC has also published guidance on how organizations can adapt vulnerability-management programs as AI changes how vulnerabilities may be discovered and exploited.”
The size of this cyber-focused crowd underscores that cybersecurity is a constant battle and is dependent on information sharing and coordination.
Jason W. Richards
“The challenge is making sure the right organization can access the right capability quickly enough to matter,” explains Jason Richards, an FBI veteran who is principal of JWR Strategies. “During an attack, we need to know who has the relevant intelligence, who has the authority to act, who owns the affected system and who can isolate, reroute, investigate, restore or sustain operations.”
“My work focuses on the intersection of national security, cybersecurity, critical infrastructure, and state and local government – particularly the growing exposure of communities and essential services to hostile state activity from Russia, China, Iran and North Korea,” says Joshua Burgin, founder of the Alliance for Global Security. It is a nonpartisan group working with U.S. and European leaders on cybersecurity and cyber defense challenges and strategies.
Tom Markert, president of the InfraGard National Members Alliance, an FBI-affiliated nonprofit in public-private partnership mode, is also city commissioner of Delray Beach, Florida. He says this gives him a perspective across private-sector risk, national security, and local government.
Joshua Burgin
“As AI continues to develop, it will be more important than ever for public-and-private partnership to expand,” Markert observes. “Healthy information sharing with law enforcement and industry professionals will help to ensure this new technology stays on a positive track.”
Burgin contends that states need to play a larger coordinating role, as many smaller jurisdictions do not have the staff, expertise or purchasing power to defend themselves adequately.
He is concerned that unclear delineations of responsibilities between levels of government, and uneven capabilities, leaves them “woefully underprepared . . . Too much of the cybersecurity conversation still happens in Washington.”
“Governors and emergency-management agencies should also treat major cyber incidents more like other statewide emergencies, with regular exercises and relationships built before a crisis,” Burgin adds. As part of a more robust national security conversation, “we need more direct threat briefings, regular exercises and simulations, modernization of legacy systems, stronger minimum standards, and better access to affordable cybersecurity services for smaller jurisdictions.”
Markert says that to address security gaps, risk professionals “inside companies big and small must have the tools to flag security gaps as a part of the continuous vulnerability assessment process. Leadership, including boards of directors, must understand the business risks and take proactive steps to safeguard their company assets. If security is not a priority, the business is vulnerable to an attack. Attacks can be small or catastrophic.”
Says JWR’s Richards, “The questions I would be asking are: Can we see risk changing as it happens? Can we adapt before an event becomes a crisis? Can we keep essential functions operating while we respond? Do we know what external resources are available and whether they can integrate quickly with our internal capabilities? Are we choosing systems that perform against these new metrics?”
Jeffrey Kutler of GARP contributed reporting for this article.