CISA Kicks Off Critical Infrastructure Security Month 2026

Executive Summary

On November 2, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) officially commenced its annual Critical Infrastructure Security and Resilience Month. This nationwide campaign, running throughout November, is designed to raise awareness about the importance of securing the assets, systems, and networks that are essential to the nation's security, economy, and public health. This year's initiative places a special emphasis on the human element of security and the need for preparedness against emerging threats, including those posed by artificial intelligence. CISA is providing resources and calling on partners in both the public and private sectors to bolster their security posture by focusing on core resilience practices.

Regulatory Details

While not a formal regulation, the Critical Infrastructure Security and Resilience Month serves as a national campaign to promote voluntary adoption of security best practices and principles outlined in government strategies, such as the White House's National Resilience Strategy. The initiative acts as a public-private partnership driver, encouraging organizations to align with CISA's guidance.

CISA is promoting four key practices for infrastructure owners and operators:

1. Identify What's Critical: Know your most essential systems, functions, and dependencies.
2. Understand the Risks: Assess the specific threats and vulnerabilities relevant to your organization and sector.
3. Make a Plan: Develop and maintain clear, actionable incident response and recovery plans.
4. Learn and Adapt: Continuously update plans based on exercises, incidents, and evolving threat intelligence.

Affected Organizations

The campaign targets all owners and operators of critical infrastructure in the United States. This includes, but is not limited to, the 16 critical infrastructure sectors defined by the DHS:

• Chemical
• Commercial Facilities
• Communications
• Critical Manufacturing
• Dams
• Defense Industrial Base
• Emergency Services
• Energy
• Financial Services
• Food and Agriculture
• Government Facilities
• Healthcare and Public Health
• Information Technology
• Nuclear Reactors, Materials, and Waste
• Transportation Systems
• Water and Wastewater Systems

Impact Assessment

The initiative aims to have a positive impact by improving the overall security and resilience of the nation. By encouraging proactive security measures, CISA hopes to reduce the likelihood and impact of successful cyber and physical attacks against essential services. For participating organizations, the short-term impact involves dedicating resources to review plans, conduct exercises, and raise employee awareness. The long-term impact is a stronger security posture, reduced risk of costly disruptions, and greater alignment with national security objectives. The focus on AI acknowledges the shifting threat landscape and the need for organizations to prepare for more sophisticated, automated attacks.

Compliance Guidance

To participate and align with the month's goals, CISA encourages organizations to take the following steps:

1. Use the CISA Toolkit: CISA has provided a toolkit with resources, social media graphics, and informational materials that organizations can use to promote the campaign internally and externally.
2. Conduct a Tabletop Exercise: Use one of CISA's tabletop exercise packages to test your incident response plan against a realistic scenario. This helps identify gaps in a low-stakes environment.
3. Review Dependencies: Re-evaluate your organization's critical dependencies, including third-party suppliers, cloud service providers, and managed service providers. The security of your organization is linked to the security of your partners.
4. Promote Security Awareness: Run an internal awareness campaign for employees, focusing on topics like phishing prevention, strong password hygiene, and reporting suspicious activity. As Acting CISA Director Nick Andersen stated, "Resilience comes from knowing what matters most and having a plan you can actually use when something goes wrong."