The consequences of cyberattacks extend beyond agency IT departments. Traditionally, we think of cyber protection as a technology issue and respond accordingly e.g., how to recover from an incident, how to identify and mitigate attacks, how to prevent exfiltration and other technical fixes. Given the stakes, cybersecurity threat response requires a different mindset that views attacks as resulting in the same “whole of society” consequences as a natural disaster or physical attacks that have endangered lives. These impacts, at a minimum, may be similar to the disruption we all felt with the recent CrowdStrike/Microsoft outage. While not due to a cyberattack, that incident still resulted in air travel disruptions and other impediments felt beyond IT departments. In worse cases, the impacts of cyberattacks could be the equivalent of the destructive consequences of a natural disaster, such as a hurricane. Should there be a universal approach to cyber threats ?

