CISA’s 2026 Cybersecurity Awareness Month theme, “Securing the Next 250,” puts critical services such as power and water at the center of the conversation. The theme is broad. Much of the work behind it is routine: reduce exposure, replace unsupported technology and prove that recovery works.

That routine work becomes difficult in a utility, public-safety environment or operations center where downtime has an immediate consequence. A security recommendation that ignores availability is not an operational plan.

Why patching is only part of the answer

Verizon’s 2026 report found that vulnerability exploitation accounted for 31% of initial access in breaches. Only 26% of critical vulnerabilities in CISA’s Known Exploited Vulnerabilities catalog were fully remediated by organizations in 2025. For teams responsible for long-lived or continuously operating systems, the issue is not simply whether to patch. It is how to reduce exposure while testing and scheduling a safe change.

CISA summarizes the approach as Reduce, Replace, Recover: reduce unnecessary exposure, replace technology that can no longer be supported, and prepare to recover when prevention is not enough.

Cloud controls still belong to the customer

Cloud providers secure the underlying facilities and core platform. Customers remain responsible for how identities, permissions, network rules, data and applications are configured. The line is easy to describe, but day-to-day mistakes usually happen in ordinary changes and exceptions:

• Storage left open to the internet by a single setting
• Admin accounts without MFA
• “Temporary” permissions that never got removed
• Logging switched off, or on and never read
• Test environments holding copies of real data

Operational environments add constraints

IT and OT are increasingly connected. Monitoring and analytics create value, but each connection also needs a clear purpose, owner and control boundary.

Some equipment cannot be patched on a normal business schedule. In those cases, segmentation, tightly controlled access and monitoring become essential compensating controls.

Many public-sector and utility teams carry a wide scope with limited staffing. Around-the-clock monitoring may require outside support, but accountability for priorities and response still remains with the organization.

Seven practices I would prioritize

1. Start with identity. MFA everywhere, single sign-on, least privilege, regular reviews of admin access.
2. Segment by criticality. Operations apart from business systems. Production apart from development.
3. Use guardrails, not memory. Account-wide policies that block public storage and require encryption automatically.
4. Log centrally and watch it. Alert on new admin accounts, disabled logging and unusual data transfers.
5. Encrypt by default, and control who holds the keys.
6. Design for recovery. Backups isolated from production, critical systems replicated, restores tested.
7. Rehearse the bad day with operations, communications and leadership in the room, not just IT.

These practices are not equally urgent everywhere. CISA’s Cross-Sector Cybersecurity Performance Goals can help smaller organizations choose a defensible starting point, and CISA also offers free cyber hygiene services.

Where to start

SVAM has supported public-sector, utility and public-safety organizations for more than three decades. Our cloud, AWS and security teams work together so that identity, logging, recovery and operational constraints are considered during a migration rather than after it. Managed services can also extend monitoring, patching and response coverage for teams that cannot staff every shift. A review is available at svam.com/cybersecurity-awareness-month/.