The United States national resilience strategy is the federal framework, anchored by National Security Memorandum 22 signed in April 2024, that organizes 16 critical infrastructure sectors under designated federal agencies, sets cybersecurity and incident-reporting standards, and uses grants, contracting power, and penalties to push owners and operators toward measurable resilience. It replaced Presidential Policy Directive 21 and tightened how the federal government identifies risk, coordinates response, and holds infrastructure owners accountable. If your organization owns, operates, or supplies anything the government considers critical, this framework now shapes what you must do, what you can get help with, and what happens if you fall short.
What NSM-22 Does
NSM-22 is the foundational document driving federal resilience policy today. It reaffirms the 16 critical infrastructure sectors, assigns a specific federal department or agency to manage risk within each, and empowers the Department of Homeland Security to lead a whole-of-government effort to secure them. The Cybersecurity and Infrastructure Security Agency (CISA) acts as the national coordinator for security and resilience across all sectors.1Cybersecurity and Infrastructure Security Agency. National Security Memorandum on Critical Infrastructure Security and Resilience
The memorandum’s eight core objectives point away from reactive disaster response and toward proactive risk management. Among them: establishing minimum security requirements and accountability mechanisms, leveraging federal grants and procurement to push owners and operators toward higher standards, improving real-time intelligence sharing at the lowest possible classification level, and promoting cost-effective investments in technologies that mitigate evolving threats. The use of federal contracting power as a lever is relatively new and signals that organizations doing business with the government face growing pressure to demonstrate resilience.
The 16 Critical Infrastructure Sectors and Who Oversees Them
Federal policy organizes the nation’s most essential systems into 16 sectors, each with its own risk profile and a designated Sector Risk Management Agency (SRMA) responsible for oversight. The complete list:
- Chemical
- Commercial Facilities
- Communications
- Critical Manufacturing
- Dams
- Defense Industrial Base
- Emergency Services
- Energy
- Financial Services
- Food and Agriculture
- Government Facilities
- Healthcare and Public Health
- Information Technology
- Nuclear Reactors, Materials, and Waste
- Transportation Systems
- Water and Wastewater Systems
These designations determine which federal agency you deal with, which compliance obligations apply, and where federal grant money and technical assistance flow. The Department of Energy leads on energy, the Department of Health and Human Services on healthcare and public health, the Department of the Treasury on financial services, and the Environmental Protection Agency on water and wastewater. The Secretary of Homeland Security reviews the sector list and agency assignments at least every five years and recommends changes to the President as needed.2Office of the Law Revision Counsel. 6 U.S. Code 665d – Sector Risk Management Agencies
One boundary worth naming: the Federal Energy Regulatory Commission oversees the electrical grid, natural gas pipelines, hydropower dams, and liquefied natural gas terminals through its Office of Energy Infrastructure Security, but it does not regulate petroleum refineries or oil pipelines.3Federal Energy Regulatory Commission. Office of Energy Infrastructure Security4Federal Energy Regulatory Commission. Oil If you operate in energy, confirm which agency actually holds jurisdiction over your assets before you build a compliance program around the wrong one.
Cybersecurity Standards You Will Be Measured Against
The primary technical benchmark is NIST Special Publication 800-53 (Revision 5), which catalogs security and privacy controls across 20 families, from Access Control and Incident Response to Supply Chain Risk Management and Contingency Planning. The August 2025 release (version 5.2.0) added new controls specifically targeting cyber resiliency, including requirements for logging syntax standards and root-cause analysis.5NIST. SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations
Two executive orders sit on top of those baseline controls. Executive Order 14028 (May 2021) directed federal agencies to adopt zero-trust architectures, deploy multifactor authentication, and encrypt data across federal networks.6Cybersecurity and Infrastructure Security Agency. Executive Order on Improving the Nation’s Cybersecurity Executive Order 14144 (January 2025) then required software vendors selling to the federal government to submit machine-readable secure development attestations and artifacts through CISA’s Repository for Software Attestation and Artifacts. It also set deadlines for agencies to enroll endpoints in CISA’s Persistent Access Capability program and mandated preparation for post-quantum cryptography, with a target of supporting Transport Layer Security 1.3 or later by January 2030.7Federal Register. Strengthening and Promoting Innovation in the Nation’s Cybersecurity
These orders bind agencies directly. They reach private-sector organizations through federal contracting requirements. Sell software or technology services to the government and you should expect to demonstrate compliance as a condition of doing business.
Cyber Incident Reporting Under CIRCIA
The Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) created a federal requirement for covered entities to report significant cyber events directly to CISA. Under the statute, organizations that experience a covered cyber incident must report it within 72 hours of reasonably believing the incident occurred. Ransom payments made in response to ransomware attacks must be reported within 24 hours of payment.8Cybersecurity and Infrastructure Security Agency. Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA)
These requirements are not yet enforceable. CISA must complete mandatory rulemaking before the reporting obligations take effect, and as of early 2026 the final rule is still pending. Once it is finalized, organizations within CIRCIA’s scope will face concrete deadlines with enforcement consequences. If your organization sits inside any of the 16 sectors, aligning your incident response procedures to the 72-hour and 24-hour clocks now is far cheaper than scrambling after the rule drops.
Water System Deadlines Under AWIA
Community water systems serving more than 3,300 people face specific resilience requirements under the America’s Water Infrastructure Act. These systems must complete and certify Risk and Resilience Assessments (RRAs) and Emergency Response Plans (ERPs) on a five-year cycle. For the current cycle:
- Systems serving 3,301 to 49,999 people must certify their RRAs by June 30, 2026, and their ERPs by December 31, 2026.
- Systems serving 50,000 to 99,999 must certify their ERPs by June 30, 2026.9US EPA. AWIA Section 2013/SDWA Section 1433: Risk and Resilience Assessments and Emergency Response Plans
Missing these deadlines carries real consequences. The EPA can issue compliance orders and seek civil penalties of up to $69,733 per day of violation under the Safe Drinking Water Act. The figure is adjusted annually for inflation.
Supply Chain Reviews
Executive Order 14017, signed in February 2021, directed federal agencies to conduct deep reviews of the supply chains the country depends on most. The initial 100-day review focused on four areas: semiconductor manufacturing, high-capacity batteries (including electric vehicle batteries), critical minerals and rare earth elements, and pharmaceuticals and active pharmaceutical ingredients. Broader sectoral assessments followed for the defense industrial base, public health, information and communications technology, energy, transportation, and agriculture.10Cybersecurity and Infrastructure Security Agency. Executive Order 14017 on Securing America’s Supply Chains The work maps production pathways, identifies dependencies on single-source foreign suppliers, and pushes toward diversified sourcing so a disruption in one country does not shut down an American industry.
Federal Help That Is Actually Free
Two pieces of federal support are worth knowing about because most eligible organizations underuse them.
CISA Cyber Hygiene Services
CISA provides no-cost vulnerability scanning and web application scanning to any U.S.-based organization, including federal, state, local, tribal, and territorial governments and private-sector critical infrastructure operators. The vulnerability scanning service continuously monitors internet-accessible network assets for open ports, exposed services, risky configurations, and known exploited vulnerabilities. The web application scanning service examines publicly accessible web applications for misconfigurations and common security flaws. Scanning typically begins within three business days of enrollment, with reports arriving within two weeks. Participants receive weekly vulnerability reports and ad-hoc alerts for urgent findings. According to CISA, participants typically reduce risk exposure by 40 percent within the first year, with improvements visible within 90 days. The service is confidential and intended for remediation rather than regulatory reporting.11Cybersecurity and Infrastructure Security Agency. Cyber Hygiene Services
CISA also offers the Cyber Security Evaluation Tool (CSET), a free desktop and web-based tool that walks asset owners through a step-by-step assessment of control systems and IT network security against recognized government and industry standards.12Cybersecurity and Infrastructure Security Agency. Assessment Evaluation and Standardization Program
Federal Grants
The Building Resilient Infrastructure and Communities (BRIC) program, administered by FEMA, funds hazard mitigation projects like school safe rooms, utility hardening, relocating critical facilities out of flood zones, and securing pump stations. Eligible applicants include states, U.S. territories, federally recognized Tribal Nations, and local governments. For the fiscal year 2024/2025 funding cycle, the application window through FEMA Grants Outcomes (FEMA GO) opened March 25, 2026, with a deadline of July 23, 2026.13FEMA.gov. Building Resilient Infrastructure and Communities The standard cost share is 75 percent federal and 25 percent nonfederal, though economically disadvantaged rural communities may qualify for up to 90 percent federal funding.
The State and Local Cybersecurity Grant Program (SLCGP) funds cybersecurity improvements at the state and local level. For fiscal year 2025, the program allocated $91.75 million in total federal funding.14FEMA.gov. Fiscal Year 2025 State and Local Cybersecurity Grant Program Key Changes Grants flow through state administering agencies and can support workforce development, cybersecurity planning, and implementation of security controls for state and local government systems.
Penalties for Falling Short
Enforcement varies by sector and obligation, but it is real. Water systems face civil penalties of up to $69,733 per day for failing to complete required risk assessments or emergency response plans under the Safe Drinking Water Act.
Federal contractors face something arguably more painful. Under the Federal Acquisition Regulation (FAR Subpart 9.4), agencies can suspend or debar contractors who demonstrate a lack of business integrity, including those who make false statements, fail to perform on government contracts, or engage in fraud. Debarment excludes an organization from all federal contracting, not just the agency that imposed it, for up to three years. The exclusion applies to the contractor, its subcontractors, and their principals. Due process protections require written notice, specific reasons, and a 30-day window to respond before debarment becomes final.
CISA also holds administrative subpoena authority under 6 U.S.C. ยง 659(p). When CISA identifies an internet-connected system with a security vulnerability tied to critical infrastructure and cannot identify who owns it, the agency can compel the production of information necessary to notify the entity at risk.15Cybersecurity and Infrastructure Security Agency. CISA Administrative Subpoena The authority is narrow and exists to find and warn vulnerable organizations, not to punish them, but it shows how seriously the federal government treats identification of exposed infrastructure. Once CIRCIA’s final reporting rules take effect, additional enforcement mechanisms for failure to report covered cyber incidents and ransom payments will come into play.
Getting Access to Federal Information Sharing
Much of the information exchange between private-sector organizations and the federal government runs through the Homeland Security Information Network (HSIN), DHS’s official platform for sharing sensitive but unclassified information among federal, state, local, tribal, territorial, international, and private-sector partners.16Department of Homeland Security. Homeland Security Information Network
Access requires more than a username and password. Private-sector users who are U.S. citizens must register for a Login.gov account, which involves providing a state-issued photo ID (federal, military, and passport IDs are not accepted), a Social Security number, and a smartphone for identity verification. If you have moved within the past two years, you may need to enter your previous address for validation, and any credit report freeze must be lifted temporarily during identity proofing.17Homeland Security. How to Join the Homeland Security Information Network (HSIN) Once your HSIN account is active, you can browse the Community Directory to request access to specific Communities of Interest relevant to your sector. If a community is not visible, you will need an access code from the community’s owner or access approver.
Three friction points cause most registration failures: a mismatch between your Login.gov email and your HSIN email, an active credit freeze during identity proofing, and using an unaccepted ID type. Sort those out before you start.
Where This Is Heading
The direction of federal resilience policy is steady movement from voluntary guidance toward enforceable requirements. NSM-22 pushes accountability through grants and procurement. CIRCIA will convert incident reporting from best practice into a deadline-driven legal obligation. Executive Order 14144 pulls software vendors into the compliance perimeter through contracting. Organizations that treat resilience as optional today may find themselves locked out of federal contracts or facing daily penalties tomorrow. The organizations that fare best are the ones building assessment, reporting, and documentation habits now, while the free federal tools are still the easiest way in.