3 Steps Government Policymakers Can Take to Reduce Critical Infrastructure Cyber Attacks

Recommendation: Establish a cross-agency risk registry to identify exposure across connected public systems, then align policies to enhance protection and simplify managed services.

Action 1: Build and track a unified information-sharing loop among agencys and private partners to identify many risks, including crimes and sensitive data exposure.

Action 2: Deploy a product-based protection approach and managed services, anchored by policies that enable you to track costs and benefits across public-facing systems.

Action 3: Update procurement and internal policy with standardized controls, require agencys to report currently ongoing risks and incidents, and then apply general information to inform budgets and program updates for agencys themselves.

Practical data protection framework for critical infrastructure

Implement a dedicated data protection program for key services networks, applying formal data classification and continuous monitoring to rising risks and to combat persistent intrusions.

Understand the threat landscape by mapping assets, data flows, and user journeys across cyberspace. According to CISA, align control design with those who operate, rely on, or depend on these networks, and sustain continuity by enforcing segmentation and least-privilege access.

Adopt a defense-in-depth approach: identify data that requires protection, encrypt data at rest and in transit, and manage keys through dedicated processes. Leverage MFA, fine-grained access controls, and quarterly access reviews, while maintaining a strong posture at network edges and endpoints, including health services and other providers.

Establish clear incident handling and reporting rituals: define runbooks, conduct tabletop exercises quarterly, and report incidents to relevant entities promptly to shorten dwell time and prevent secondary compromises. Maintain 24/7 monitoring and rapid containment for real-time cyberspace activity.

Establish a risk-based data protection baseline for OT and IT networks

Although urgency exists, implementing this baseline is difficult but necessary. A single, organization-wide baseline consolidates OT and IT asset inventories and data flows into one view. This fact informs a manager’s strategy to protect vital data and lower exposure across the power and industry sectors. The baseline should be actionable and feasible to develop within 60 days, with a clear order of priority for data categories and flows. The plan helps managers understand exposure points and the value of data protection.

Agency leadership should commission a national standard that generalizes a risk-based baseline for connected networks and the workforce. The framework must be measurable, aligned with existing compliance, and updated quarterly to reflect real incidents and rising threats. Digital crimes have surged, underscoring the need for a formal baseline. Identification of high-value assets and data flows should be completed by the identified owners, with the capability to move remediation actions into the execution plan quickly. This ensures risks that have been identified are captured in the baseline.

Key actions include: identify assets and data flows to close gaps; move segmentation between OT and IT where feasible; enforce least-privilege access for managers and engineers; require MFA for admin accounts; encrypt sensitive data at rest and in transit; implement a 30-day patch-and-firmware cycle for items with high risk; conduct quarterly exercises to test response; establish an incident response playbook. This move lowers exposure and makes the organization more resilient against attackers.

To gauge progress, adopt a fact-based dashboard: the percentage of connected devices with current firmware, the percentage of data flows classified, the time to containment for incidents, and the mean time to recovery. Real incidents in the past year show rising threat activity across the network, especially where workforce awareness is weak. When controls bounce across sites without alignment, containment becomes slower. A general trend shows that organizations with a clear baseline face fewer breaches and faster recovery compared with peers in the industry. This pattern confirms that governance and the baseline routine are crucial.

Monitor and verify identified controls continuously; the commission can require quarterly audits, with a national dataset to benchmark performance across the sector. In practice, a well-managed, connected network moves toward a resilient posture even when facing sophisticated threat actors. Overall, the baseline is vital for consistent risk management and helps the workforce understand the role of data protection in daily work.

Mandate encryption, key management, and data minimization across critical systems

Require encryption by default for data at rest and in transit, deploy centralized key management, and implement automated data minimization across essential assets to prevent data loss and limit exposure.

1. Encryption and key governance across essential assets:

   • Encrypt data at rest and in transit by default, using FIPS-validated cryptographic modules; centralize key material in a hardware security module (HSM) or cloud KMS with automated rotation and strict access controls. Separate duties so no single role can both access data and control keys; enforce immutable audit trails to support incident analyses. Include key escrow where required to prevent loss and enable recovery. Leverage your technology stack to automate enforcement across all repositories and communications; krishnan notes centralized control and regular validation of cryptographic implementations strengthen resilience and help identify weaknesses that hackers may exploit.

2. Data minimization and controlled data flows:

   • Document some data types collected and justify their necessity (needed) for service delivery; classify data and apply retention limits; anonymize or pseudonymize where feasible; automate purge of stale records after defined periods. Limit sharing to necessary partners within the supply chain and require encryption in transit for transfers; keep subject data to the minimum required, and tailor handling policies to the needs of health and other sectors. Demonstrate the importance to economies and leverage this approach to meet some policy objectives while reducing exposure.

3. Governance, oversight, and incident response:

   • Establish a cross-agency commission to set role definitions and accountability; align enforcement with policies across economies and sectors, including others; integrate intelligence on rising threats and targeting by hackers; ensure governance in cyberspace and in health and other essential services; maintain pace with evolving risks and lead the way with incident playbooks and exercises. Capture the actions taken and apply lessons learned to close weaknesses in a timely place, showing the value of stronger leadership.

Enforce zero-trust access for remote maintenance and vendor connections

Adopt a zero-trust access model for remote maintenance and vendor connections, requiring short-lived credentials, device posture checks, and continuous session verification for each interaction. This approach strengthens business resilience by ensuring authentic identities, controlled access, and auditable activity across systems.

• Identity and device verification: Enforce certificate-based authentication and MFA for every vendor and technician; integrate with a single identity provider; require ongoing posture checks from enrolled devices and route logs to a centralized data store; policies should be reviewed regularly to confirm alignment with risk appetite and role expectations.
• Access scope and least privilege: Map each vendor task to a defined portfolio of systems; apply role-based access control and time-bounded sessions; restrict commands and data exposure to what is strictly necessary; this reduces significant impact while preserving agility for business needs.
• Mediated connections and session control: All remote access to core systems must pass through a secure gateway or jump host with mutual TLS; block direct vendor connections; enforce granular session boundaries and automatic termination when the task completes; track actions in an immutable log.
• Monitoring, data track and auditing: Enable continuous monitoring of sessions; track data movements and configuration changes; maintain an auditable breakdown of actions for reviews; set near-real-time alerts for anomalous behavior; ensure data currently informs risk decisions.
• Lifecycle, health and developing technology management: Maintain an up-to-date inventory of assets and vendor portfolios; require that changes from developing projects are tested in a controlled environment before deployment to life-supporting systems; monitor system health and automate remediation where feasible.
• Governance, oversight and continuous improvement: Align with business priorities; borough IT teams and agencys oversight should be part of policy review; continuously improve techniques and policies; track performance metrics and the importance of these controls to the wider technology portfolio; this framework should help this portfolio stay resilient as it grows.

Segment networks and implement continuous monitoring with real-time alerting

Implement a segmented topology across your regional network and deploy continuous, real-time alerting in a centralized, managed console. This approach will lead to lower exposure by keeping services in isolated zones and applying dynamic access controls. Use a single management plane to coordinate alerts, policy changes, and response playbooks, so your team can act quickly.

Begin with a regional map of where your assets reside and identify where services are publicly accessible. In each region, map exposure and asset importance. For each zone, assign a trusted vendor and implement tight controls. Include threat intelligence to sharpen detection and monitor indicators from recent fact patterns since the last election. Maintain a heap of incidents and lessons learned to adapt quickly.

Ensure services stay connected through controlled boundaries: called micro-segmentation and zero-trust frameworks; implement power-limited access. Use a managed security stack that supports real-time notifications, automation for containment, and a plan for ongoing changes. The aim is to prevent a single attack from propagating across many regions and services, just in case of containment failures.

From a national perspective, align with a plan that covers vital planning around supply chain, vendor risk, and defense during high-tension periods such as elections. Security teams have been focusing on intelligence, and should continue to lead with intelligence, and adapt tactics to the threat landscape where hackers are currently targeting assets. Focus on the fact that most intrusions begin with exposed services and weak configurations; close those gaps first.

To quantify progress, monitor exposure levels, time to detect, and time to contain. Use regional dashboards and continue refining the tactics based on intelligence and facts. Maintain a heap of proven playbooks since the early days, including inputs from dell and other vendors. Prepare for the next attack and adjust segmentation accordingly. Across the world, adoption of these practices keeps power and services connected.

Build incident response, data backup, and recovery playbooks with drills

Identify the assets that matter most in region-specific operations and appoint a lead for subject areas such as data, network, and health systems. Create a dedicated agencys team to run incident response, data backup, and recovery activities, with a strategy that is understandable by different organization units. This approach helps governments set standards and targeted actions so the program can combat threats when they surface. Just enough procedures to avoid overburdening teams.

Build a data backup playbook that covers scope, cadence, encryption, off-site copies, and integrity checks. Choose a product with versioning and air-gap isolation; test restoration monthly and document the results in a central heap for security review. Schedule automated backups to run fully, with alerts when a restore test fails, and understand the health of each data tier.

Develop a recovery playbook with clear RTO and RPO targets for essential services. Map the network dependencies and identify key recovery sequences, prioritizing different organization units and regions. Use standardized procedures to ensure that recovery steps are repeatable, scalable, and aligned with agencys, standards, and policy. Train teams to understand how to execute the plan during a drill and to document gaps.

Drill program: tabletop, simulated intrusions, and live restoration exercises. Schedule when to run drills; involve stakeholders from governments, regions, and organizations. Use objective scoring for detect-and-contain time, restoration time, and data integrity; capture lessons in a succinct after-action report and update playbooks accordingly.

Governance and improvement: maintain a living catalog of issues and improvements; keep the heap of incident learnings accessible to all, ensuring the subject of data protection and security topics is addressed. Align with standards and targeting of risk; measure health indicators like mean time to identify, time to understand, and time to recover; this ensures region-wide resilience at scale.