Government Unveils New Plan to Protect Critical Infrastructure. There's a Catch.

Remember when the government and private companies used to actually talk about cybersecurity? Good news: The Department of Homeland Security (DHS) is trying to bring that back. They've proposed a new system, ANCHOR-CI, designed to protect the nation's critical infrastructure — you know, the stuff that keeps our lights on, water flowing, and internet... well, interneting.

This new system is stepping in to fill a rather large, Trump-administration-sized hole left by its predecessor, CIPAC. When CIPAC was unceremoniously axed, many of those critical infrastructure operators — the folks who actually run the power grids and water treatment plants — were left wondering who they were supposed to call when things got dicey. It turns out, disrupting those partnerships wasn't ideal for national security. Who knew?

Councils, Councils Everywhere

ANCHOR-CI aims to fix that by creating advisory councils. These aren't just your average potluck committees. We're talking about a mix of infrastructure operators, government officials, and cybersecurity experts all sitting around a (presumably very secure) table. Their mission? To swap notes on threats, vulnerabilities, and how to keep everything from cyberattacks to actual, physical disasters from bringing us to our knees.

DHS is offering up four flavors of councils:

• Sector-specific: Think power grid folks talking to power grid government agencies.
• Cross-sector: When the power grid problem also affects the water supply, these folks jump in.
• Industry: For the big players whose work spans multiple sectors.
• Regional: Because apparently, security is best managed locally, with a federal assist. They even want to make sure rural areas get a seat at the table, which is a nice touch. No more forgetting about the folks who keep the corn growing and the local internet provider... providing.

This all sounds remarkably similar to the old CIPAC framework, which was established way back in 2006. That system also used these sector- and government-coordinating councils, allowing for those hushed, sensitive discussions between government and industry that make everyone feel a little safer. Since its demise, industry reps have been pretty vocal about wanting a replacement, noting that without those protections, sensitive info just wasn't getting shared. Because, naturally, if you can't talk about a potential cyber threat without fear of a lawsuit, you probably won't talk about it at all.

Plans for ANCHOR-CI actually started in early 2026 (yes, we're talking future-past here, apparently), but leadership changes at DHS caused some delays. Because of course they did. The software industry group BSA has already given it a thumbs up, with Henry Young, their senior director of policy, noting it "strengthens trusted collaboration." Which, if you think about it, is a fancy way of saying, "We can finally chat again."

But here's the catch, and it's a big one: ANCHOR-CI doesn't come with the liability protections that CIPAC offered. Those protections were basically a shield, letting companies share sensitive information without immediately picturing their legal team having a meltdown. As Errol Weiss, chief security officer at the Health Information Sharing and Analysis Center, dryly observed, "the government needs to address the legal exposures" to encourage any real information sharing. Because nobody wants to be a hero if it means getting sued.

The Cybersecurity and Infrastructure Security Agency (CISA) will be running the show, approving members and ensuring diverse representation across councils. ANCHOR-CI is slated for an initial two-year run, with the option for indefinite renewal. Here's hoping they sort out those liability issues, because as Jennifer Lyn Walker from WaterISAC put it, "Only time will tell." And we'd all prefer that time not involve a major infrastructure collapse, thank you very much.