Securing Critical Infrastructure in the Cloud Era: A Policy and Technology Blueprint

The report argues that as U.S. critical infrastructure migrates to the cloud, traditional defenses are eroding, sophisticated adversaries (e.g., Volt Typhoon, Scattered Spider) are leveraging credential theft and living-off-the-land techniques, and IT/OT boundaries are blurring (e.g., Colonial Pipeline), necessitating an adaptive, outcome-driven security framework. It recommends coordinated actions across levels—at the **Federal Government** level (modernize sector rules for the cloud era, fund modernization and training, and supercharge threat intelligence sharing), **State and Local Governments** (create cybersecurity commissions, integrate cyber-physical scenarios into drills, require SBOM-on-demand and IaC in procurement, and provide coordinated resiliency support), and **International Cooperation** (establish norms protecting civilian CI and harmonize incident reporting)—with Wiz offering to partner with agencies and operators to implement these measures.