IC Technology & Cyber — 2026-09-20

CISA Hosts Cyber Storm X Nationwide Exercise With 2000 Participants Simulating Nation-State Attack on Critical Infrastructure

BLUFCyber Storm X's value hinges on whether CISA's promised after-action report drives binding updates to cross-sector incident playbooks or remains a shelf document.

CISA hosted Cyber Storm X this week, a four-day national exercise drawing roughly 2,000 participants from federal, state, and local government along with private industry, marking the tenth iteration in the program's 20-year history 1. The scenario simulated a nation-state adversary targeting the transportation sector, including rail and ports, alongside water and wastewater systems, with over 200 organizations taking part 1. TechTarget reported the exercise involved IT, legal, crisis communications, and executive personnel working in divided groups over four days, and quoted CISA Joint Cyber Defense Collaborative official Mitchell Freddura calling Cyber Storm the agency's "largest national exercise" and describing the drill as building "trust, familiarity and muscle memory" for a real crisis 2. Acting CISA Director Nick Andersen said the exercises ensure "plans, policies, and partnerships are ready" when needed, and CISA said it will work with participating organizations to compile lessons learned into a public after-action report 1.

Analysis
The exercise functions as a live pressure test ahead of CISA's looming CIRCIA rule, which will impose 72-hour breach disclosure windows on covered critical infrastructure operators. Cyber Storm X's sector selection, transportation and water systems, reflects CISA's assessment of highest-priority nation-state targets. The drill exposes governance seams, such as who holds authority to shut down revenue-generating systems and when legal counsel assumes control, that conventional SOC-focused exercises rarely test. It is unresolved whether the promised after-action report translates into concrete changes to information-sharing protocols or incident playbooks.

3 sources