CXC Insight: The White House’s National Resilience Strategy
The White House's new America-First Resilience Strategy contains many principles familiar to the critical infrastructure community, including shared responsibility and risk-informed resilience, but it also reflects a shift in how the federal government approaches national resilience. More than introducing new programs or requirements, it reflects a broader policy direction: resilience is expected to be delivered through state, local, tribal and territorial governments, the private sector, and communities or individuals.
Here are the major questions we’re considering when it comes to how this impacts the cross-sector community:
1. How will the shift in responsibility impact critical infrastructure in practice?
Shared responsibility is not a new concept. Industry has long been responsible for securing privately owned infrastructure, and has worked closely with partners at the Federal, State, and local government levels to do so. What appears to be evolving is the expectation that industry and non-federal players will be shouldering more direct responsibility.
What does that look like in practice? Will it result in greater flexibility for owners and operators? Will states assume larger leadership roles? Will private sector be expected to fill capability and resource gaps once addressed through federal programs? And notably, how will sectors with limited resources, particularly those composed of small municipal or local operators, adapt if federal support becomes more limited? The ability to absorb additional responsibilities varies significantly across sectors.
2. How will risk-based prioritization change investment and resource decisions?
The strategy emphasizes a shift to a more risk-informed approach to resilience. Taken at face value, this sounds reasonable: resources should be directed toward the risks that matter most rather than spread evenly across every possible hazard.
But the emphasis on prioritization also raises broader questions. Is "risk-informed" primarily a planning philosophy, or is it also a signal that governments at every level will be expected to make more difficult choices about where resilience dollars are spent? If federal investment becomes more targeted, states, local governments, and private-sector owners may increasingly be expected to determine which assets, capabilities, and risks warrant investment…and which do not. For many critical infrastructure owners and operators, this is already reality. Security and resilience programs routinely compete with other operational priorities. The strategy appears to acknowledge that not every vulnerability can be addressed and that resilience investments should focus on the areas of greatest consequence.
The challenge lies in determining whose assessment of risk drives those decisions. National priorities may not always align with sector-specific, regional, or local operational realities.