Operational cyber resilience ensures mission-critical systems keep running during an attack rather than just keeping adversaries out. The convergence of critical infrastructure, operational technology (OT) and networked communications creates a vulnerable interface between United States defense and civilian sectors that adversaries target. Effective federal cybersecurity demands regulatory compliance and operational resilience. Focusing on the former leaves agencies unprepared to maintain missions during disruptions.
Prevention buys time. It doesn’t keep the mission running.
Advanced open-source artificial intelligence models and state-sponsored groups like Volt Typhoon accelerated attacks beyond what security teams can match.
Moreover, adversaries aren’t just stealing data. According to the Office of the Director of National Intelligence’s (ODNI) 2026 Annual Threat Assessment, they are exploiting supply chains to compromise software source code and pre-position inside federal networks. Their objective is to gain persistent access to shut down critical services, disable power grids and disrupt military readiness. For instance, hackers deployed the self-replicating Shai-Hulud worm into developer pipelines in 2025, where it slipped past perimeter defenses, harvested cloud credentials and pivoted into private and public sector networks.
Intrusions like the Shai-Hulud worm change the mission. When adversaries are already inside, prevention alone can’t protect the mission.
Design federal systems for operational continuity
Various organizations address cyber recovery in their continuity plans. But disaster recovery plans were built for natural disasters, such as power outages, floods and hardware failures. They do not adequately address disasters caused by cyberattacks or other disruptions.
Operational resilience means moving beyond an “all-or-nothing” security approach and designing systems to carry out agency missions even during a cyberattack; however, assuming security requirements without explicit contract definitions creates a false sense of security and dangerous technical gaps.
The AI-powered threat landscape creates a nearly indefensible digital environment, making legacy security models no longer viable. Agencies must pivot immediately to a model that assumes multiple daily breaches, prioritizing rapid data recovery and continuous mission operations over reliance on perimeter defense alone.
Agencies should build architectures that dynamically isolate breached segments while maintaining core mission functions. The Cybersecurity and Infrastructure Security Agency (CISA) highlights this approach through its CI Fortify initiative for defense, health and telecommunications operators. The initiative asks operators to plan around two assumptions:
- Expect third-party connections and vendor access to be severed during a crisis.
- Assume threat actors already control IT and OT networks.
In this threat environment, rapid isolation and validated recovery become the operational objectives, enabling mission continuity, data integrity and recovery of essential services.
Put recovery to the test
Untested military gear doesn’t go into combat. So why do untested recovery plans go into production every day? Closing that gap requires replacing passive compliance checklists with realistic recovery testing and breaking down the silos that slow response.
Agencies should bring security, cloud, IT and backup administrators together for regular exercises that test whether critical systems can actually be restored under pressure.
Testing should include:
- Chief information officers and chief information security officers setting agency-wide strategy, securing resources, ensuring tool interoperability and testing whether protections hold against attempts to delete immutable recovery data.
- Chief resiliency officers focusing on business and mission outcomes and less guided by stale compliance requirements or regulations.
- Cloud and IT operations managers validating production recovery through real-time restoration drills during active disruption.
- Backup administrators simulating insider threats to test resilience against compromised accounts.
Map the data agencies depend on to operate and recover
Agencies also need to know what data they hold and where it lives. When leaders can’t say where cloud data sits or who can reach it, they can’t assess an attack’s impact or plan a recovery. Three practical steps to accomplish this should include: inventory the data, identify the owners and map the dependencies.
Policy guidance for industry is a start. Federal leaders can strengthen it by modeling the same practices in their own agencies. Congress and government executives should hold federal, state and defense networks to the same standards applied to critical infrastructure operators, validating their capacity to survive, recover and execute agency missions under attack.
With rigorous testing, defined metrics and executive ownership, recovery becomes a repeatable process, and agencies can bounce back faster than an attacker expects.
Breaches are inevitable
What isn’t inevitable is whether the mission survives an attack. Agencies that deploy cyber recovery tactics the way they deploy preventative measures will keep their missions running even when adversaries are already inside.
Travis Rosiek is public sector chief technology officer at Rubrik.
The views expressed in this article are those of the author and do not necessarily reflect the official policy or position of Rubrik. These views are for informational purposes only and do not constitute business or legal advice. Organizations should consult with legal and compliance professionals to ensure their cybersecurity strategies meet all applicable federal, state, and international requirements.
Copyright © 2026 Federal News Network. All rights reserved. This website is not intended for users located within the European Economic Area.