The Trump administration has constantly curtailed U.S. efforts to harden crucial infrastructure in opposition to hybrid threats. It has reduce funding to key workplaces and departments tasked with these duties, such because the Cybersecurity and Infrastructure Safety Company, the Federal Emergency Administration Company (FEMA), and the Resilience and Response Directorate within the Nationwide Safety Council. Whereas Congress can’t fully fill these gaps with out government help and collaboration, its annual protection invoice, which handed the Home on Dec. 10, goals to reverse this troubling course and recenter resilience in U.S. protection coverage.
The 2023 Volt Storm hacking marketing campaign, during which a Chinese language state-sponsored cyber actor focused crucial U.S. infrastructure organizations, revealed why resilience must be a essential focus of protection coverage. By quietly burrowing into networks tied to vitality, water, transportation, and communications, the operation highlighted how disruption could be banked in peacetime and harvested in disaster.
The Trump administration has constantly curtailed U.S. efforts to harden crucial infrastructure in opposition to hybrid threats. It has reduce funding to key workplaces and departments tasked with these duties, such because the Cybersecurity and Infrastructure Safety Company, the Federal Emergency Administration Company (FEMA), and the Resilience and Response Directorate within the Nationwide Safety Council. Whereas Congress can’t fully fill these gaps with out government help and collaboration, its annual protection invoice, which handed the Home on Dec. 10, goals to reverse this troubling course and recenter resilience in U.S. protection coverage.
The 2023 Volt Storm hacking marketing campaign, during which a Chinese language state-sponsored cyber actor focused crucial U.S. infrastructure organizations, revealed why resilience must be a essential focus of protection coverage. By quietly burrowing into networks tied to vitality, water, transportation, and communications, the operation highlighted how disruption could be banked in peacetime and harvested in disaster.
This uncovered a brand new coercive logic guiding U.S. adversaries: Defeating Washington’s typical forces is just not essential to constrain U.S. technique if the civilian methods that these forces depend upon could be compromised. These vulnerabilities can be utilized throughout disaster or battle to sluggish U.S. mobilization, fracture public confidence, and complicate decision-making throughout moments of most stress. Resilience to such assaults, due to this fact, is a prerequisite for credible deterrence and operational freedom.
The US was shifting, albeit erratically, towards that conclusion till not too long ago. A White Home memo (NSM-22) issued by the Biden administration in April 2024 framed crucial infrastructure safety and resilience as a nationwide safety precedence and pushed the federal authorities towards clearer roles, tighter threat administration, and stronger public-private collaboration. The 2022 Nationwide Protection Technique additionally forwarded the idea of “deterrence by resilience,” arguing that stopping aggression requires the flexibility to face up to, combat by way of, and get well shortly from disruption.
The second Trump administration, nonetheless, reversed course. An government order issued in March ordered a broad overview of federal preparedness and continuity structure, explicitly concentrating on the NSM-22 and associated crucial infrastructure insurance policies. This has materially weakened nationwide resilience structure; FEMA, for instance, has weathered main employees departures and sharp reductions in coaching for state and native emergency managers. The chief department has additionally tried to cancel or divert catastrophe prevention and neighborhood resilience grants that had already been licensed and funded by Congress, triggering litigation and judicial intervention. The online impact was predictable: much less federal connective tissue; much less functionality on the seams between the federal, state, and native ranges; much less incentives for sustained preparedness funding; and in the end, much less resilience.
Now, Congress is making an attempt to rebuild resilience by way of its most dependable instrument: the Nationwide Protection Authorization Act (NDAA). The 2026 NDAA bundle treats resilience much less as a distinct segment matter and extra as a strategic requirement embedded in cyber deterrence, defense-critical infrastructure planning, vitality continuity, and industrial base illumination. Although the NDAA is in no way a unified nationwide resilience technique, it’s a step in the precise path and a reassertion by Congress that the US’ warfighting benefit rests on more and more focused civilian methods.
Probably the most strategically vital shift within the invoice is in cyber deterrence. The NDAA requires the Protection Division to develop a method to reestablish credible deterrence in opposition to cyberattacks on the nation’s defense-critical infrastructure, with interim and closing briefings to be held in 2026. The Senate Armed Service Committee explicitly maintains in part 1603 of the invoice that present approaches are insufficient, citing each the Volt Storm and Salt Storm cyberattack campaigns as proof that persistent entry and pre-positioning at the moment are commonplace options of the menace setting. In sensible phrases, Congress is pushing the Protection Division to deal with denial and endurance as core elements of deterrence, as an alternative of merely retaliating after injury has already been carried out.
The invoice additionally proposes an enlargement of authority for cyber operations that might transfer the Protection Division towards a extra operational view of defense-critical infrastructure, strengthening the underlying enabling methods which can be key to planning and operations. Such a transfer is in line with the underlying deterrence logic of resilience: fortify what issues most, scale back the payoff of assault, and power adversaries to take higher-risk, higher-cost paths to realize strategic results.
Congress can also be shifting resilience from rhetoric to equipment by establishing a Mission Infrastructure Resilience Process Power to evaluate vulnerabilities in defense-critical infrastructure that’s essential for executing protection operational and contingency plans. This ties infrastructure threat to tangible plans, not simply generic measures of high quality resembling facility situation scores. This additionally creates a prioritization mechanism to establish what breaks first, what cascades, and what should be remediated to maintain forces shifting beneath disruption. If applied accurately, this transfer may change into the spine of a planning-informed funding logic that the protection sector has struggled to maintain throughout administrations.
A resilience-centered technique additionally requires treating provide chains as protection infrastructure. Right here, Congress was unusually direct within the new NDAA, warning that the Protection Division and the protection industrial base stay reliant on single sources of provide—and, in some circumstances, adversary sources—for key elements, minerals, and uncooked supplies. The invoice criticizes present siloed mapping efforts and urges consolidation round a single provide chain mapping device, selling the pragmatic philosophy that you simply can’t mitigate what you can’t see.
Congress’s invoice additionally reinforces a broader lesson from U.S. navy help to Ukraine over the previous a number of years, a course of that has stretched the US’ munitions provide: Industrial surge capability is a warfighting requirement, and enter fragility turns into strategic fragility. Congress is, in impact, making an attempt to make provide chain fragility legible to senior leaders who in any other case default to navy platforms and power construction as the one “actual” protection investments.
Moreover, the NDAA incorporates path to coordinate and develop a method to make sure the safety, resiliency, and integrity of undersea cables, the spine of digital connectivity. This demonstrates a crucial recognition of recent dependency on these cables—that are fragile and targetable—and an understanding that their disruption would have rapid navy, financial, and political results. The invoice’s emphasis aligns with the broader premise that deterrence fails when the enabling methods of recent command, management, and logistics are assumed moderately than defended.
Lastly, the NDAA factors to allied and accomplice resilience as a strategic multiplier, together with emphasis on Taiwan’s crucial digital infrastructure capabilities. The sign is obvious: Resilience is essential to strategic competitors, as a result of adversaries will probe the weakest hyperlink in a coalition and convert it into leverage.
Whereas Congress has arguably handed the strongest resilience provisions in a technology, the protection invoice is an imperfect device for a nationwide and societal drawback of this scale. The White Home’s method treats resilience as overhead and its governance as a nuisance, shifting duty downward whereas shrinking the federal instruments that allow coherent nationwide preparedness. Congress can’t reverse this by itself; the facility and capability to coordinate throughout sectors, set sturdy expectations with personal house owners and operators, and maintain preparedness investments are federal and sometimes reside outdoors of the protection sphere. The gutting of earlier resilience-building efforts has created structural gaps that defense-focused resilience alone can’t totally fill.
Nonetheless, Congress has moved to reverse that logic, and—if applied—the protection invoice’s provisions would enhance the US’ capability to face up to assaults and provides it time to plan efficient retaliation. The following step is to deal with resilience as a warfighting requirement: construct it into readiness reporting, hyperlink infrastructure fortification to operational planning, stress-test protection provide chains with the identical rigor utilized to weapons methods, and synchronize allied resilience efforts with marketing campaign design.
Congress has initiated this crucial rebuild—the query now’s whether or not the US can end the job earlier than an adversary strikes.
