What's Happening?
Dragos, in collaboration with Accenture and the SANS Institute, has announced the launch of the Community Cyber Resilience Foundation. This new nonprofit organization aims to enhance the cybersecurity of underserved utilities across the United States,
particularly those with less than $100 million in revenue. These smaller utilities often lack dedicated IT or OT security staff and face significant hurdles in implementing cybersecurity measures due to financial constraints and complex approval processes. The Foundation will expand upon the existing Dragos Community Defense Program, which has already onboarded over 100 utilities in North America. The expanded program will now provide hardware, deployment and operational support through in-kind services from Accenture, and workforce development via SANS courses and GIAC certifications, all at no cost to the utilities. The initiative launches with $10 million in resources for its first phase, with a goal to onboard up to 500 additional utilities.
Why It's Important?
The establishment of the Community Cyber Resilience Foundation is critically important for U.S. national security and public welfare. Small utilities, despite their size, represent a significant vulnerability in the nation's critical infrastructure. As highlighted by recent attacks on water utilities and other operational technology systems, adversaries can exploit these weaker links to cause widespread disruption, impacting larger utilities and national security. The Foundation addresses a crucial gap by providing essential cybersecurity resources—software, hardware, and expert support—to organizations that are often 'below the cyber poverty line.' This initiative helps protect vital services like water and power, ensuring their reliability for communities. By strengthening the cybersecurity of these numerous small entities, the Foundation contributes to the overall resilience of the U.S. critical infrastructure, making it harder for state actors and other malicious entities to achieve their objectives. This proactive approach mitigates risks that could otherwise lead to significant economic and social consequences.
What's Next?
The Community Cyber Resilience Foundation will immediately focus on onboarding up to 500 additional U.S. utilities into its enhanced program. This involves providing them with necessary hardware, deploying and configuring cybersecurity technology, and offering training and certification for their staff. The Foundation also plans to expand its offerings over time, adding more training, support, and hands-on assistance. Several other companies are expected to contribute millions in resources in the coming months, further bolstering the Foundation's capacity. The long-term goal is to reach the tens of thousands of qualifying U.S. utilities that need support. Beyond the U.S., Dragos and its partners are exploring ways to expand the program internationally, recognizing that similar needs exist globally. The success of this initial phase in the U.S. will serve as a model for future expansion and investment in community cyber resilience.
Beyond the Headlines
The creation of the Community Cyber Resilience Foundation underscores a fundamental shift in how cybersecurity is being approached for critical infrastructure. It moves beyond a purely market-driven model, acknowledging that essential services cannot be left vulnerable simply because their operators lack the financial or technical resources to defend themselves. This initiative highlights the concept of 'cyber poverty line,' where smaller entities are disproportionately exposed to risks. The Foundation's work has profound implications for equity and access to security, ensuring that all communities, regardless of their utility's size or budget, benefit from robust cyber defenses. It also reflects a growing understanding that cybersecurity is a collective responsibility, requiring collaboration between technology providers, government, and non-profits. The emphasis on workforce development through SANS courses and GIAC certifications addresses the human element of cybersecurity, recognizing that technology alone is insufficient without skilled personnel to manage and operate it. This holistic approach aims to build a more resilient and secure society from the ground up.
