Mandatory cybersecurity for local utilities

Relying on voluntary defenses for critical infrastructure (small water systems, municipal power, hospitals) is no longer viable; the federal government must designate certain operators as critical, require baseline cybersecurity standards, provide funding and technical assistance, and enforce compliance. The argument ties a specific foreign‑linked cyberattack on Aliquippa’s water controllers to population‑scale risk from insecure industrial controllers and supply chains. — Adopting this policy would reassign costs and responsibilities from underfunded local operators to federal regulation and finance, reshaping debates over federalism, liability, critical‑infrastructure definitions, and supply‑chain control.