Chuck Brooks is the president of Brooks Consulting International and one of Executive Mosaic’s GovCon Experts.
The infrastructure that powers, connects, transports, supplies and safeguards the country must continue to function for America’s national security. This is something that is frequently taken for granted. The national security equation encompasses more than just electricity, communications, transportation, water, manufacturing, logistics, satellite systems, information networks and defense facilities. They form a networked ecosystem. Failure of one crucial element can have a domino effect on numerous others.
For this reason, the Pentagon’s new FORTRESS America program merits careful consideration. The Department of Defense is working to operationalize a new FORTRESS America Program Office, which is intended to increase the resilience of military installations and vital national capabilities against cyberattacks, sabotage, power-grid failures, supply-chain disruptions and other threats. According to Defense Secretary Pete Hegseth, the program is a “national insurance policy” for the country. The program’s acronym, Federal Operations for Resilience, Troop Resources, Energy, Supply and Survivability, encapsulates a significant paradigm shift: the resilience of the systems that underpin military power, rather than just the weapons and personnel that wield it, is increasingly critical to national security.
The holistic architecture of FORTRESS America is especially promising. The initiative acknowledges that cybersecurity, energy security, physical protection, supply chains, space systems and strategic reserves are interrelated components of national resilience rather than treating them as distinct policy issues. That strategy aligns with a point I have made time and time again in my writing: America’s vital infrastructure needs to be safeguarded as an integrated ecosystem because the threats it faces are also becoming more integrated.
As the Pentagon’s FORTRESS America program pushes resilience across military installations and the critical infrastructure they depend on, the Potomac Officers Club’s 2026 Homeland Security Summit on Nov. 10 will bring DHS leaders and industry together to discuss protecting the nation’s critical systems. Save your seat now!
From Infrastructure Resilience to Cybersecurity
Cybersecurity was frequently viewed as an information-technology issue for many years. That paradigm is no longer sufficient. In addition to being an electrical system, a modern power grid also functions as an industrial control environment, a communications network, a data ecosystem and an increasingly AI-enabled infrastructure. Electricity, telecommunications, satellite connectivity, logistics, fuel, software, industrial controls and supply chains are all essential to a military installation. Any disturbance in one of these domains may have an impact on the others.
The attack surface has significantly increased due to the convergence of IT and operational technology. Cloud services, IoT devices, remote-access technologies and increasingly complex software now interact with legacy systems that were never intended for today’s connected world. Visibility, segmentation, Zero Trust, supply-chain security and security-by-design must become essential components of infrastructure protection, according to my prior work on critical infrastructure.
Additionally, the threat is no longer limited to cyberspace. To cause strategic disruption, an adversary does not always need to break into a computer network. Targeting a substation, interfering with satellite communications, interfering with GPS and positioning services, compromising a supplier, attacking a telecommunications provider, using drones against a facility, or taking advantage of a physical weakness in a logistics network are all possible outcomes. An experienced adversary will search for the system’s weakest point. For this reason, resilience is emerging as the new national security organizing principle.
Resilience is the capacity to foresee, tolerate, absorb, recover from and adjust to that disruption. That is not the same as merely attempting to stop every attack. No defensive architecture can ensure that every intrusion or disruption will be avoided in a world of increasingly sophisticated nation-state actors, cybercriminal organizations, AI-enabled attacks, supply-chain vulnerabilities and geopolitical instability. Making sure that vital missions continue in the face of defense challenges must also be the goal. That seems to be the foundation of FORTRESS America.
National Security Is Energy Independence
The initiative’s emphasis on energy independence is among its most significant features. The Pentagon’s plan calls for large military installations to become capable of producing electricity on their own, separate from the civilian electrical grid. The strategic reasoning is simple: military installations cannot afford to suffer as a result of an adversary’s ability to disrupt the grid through sabotage, cyberattack, or another method.
Almost all other critical infrastructure sectors rely on energy. Electricity is necessary for hospitals. Electricity is necessary for telecommunications networks. Facilities that treat water require electricity. Electricity is necessary for data centers. Electricity and digital connectivity are becoming more and more important in transportation systems. Massive amounts of dependable power are needed for military installations.
Cascading failures could result from this. The convergence of IT and OT offers tremendous opportunities as well as serious vulnerabilities in the security of the energy sector. IoT sensors, AI, smart grids and predictive analytics can all increase productivity and dependability, but each new link may also open up new avenues for disruption. Redundancy, alternative energy sources, microgrids, robust segmentation and continuity-of-operations planning are thus necessary for resilience. An essential idea is acknowledged by the FORTRESS approach to energy: energy resilience is more than just an infrastructure problem. It is a capability for both national security and warfare.
Strengthening the Cyber-Physical Environment
FORTRESS America’s understanding that cybersecurity and physical security are inextricably linked is its second key strength. Installation hardening, cyber resilience, Zero Trust industrial-control systems, command-and-control protection and continuity-of-operations architectures are reportedly part of the Pentagon’s implementation strategy. Additionally, it requires safeguarding installations from drones, sabotage and cyberattacks.
National security must go in this direction. For instance, Zero Trust is more than just an IT architecture. Its fundamental tenet—never implicitly trust and constantly verify—can be used in a variety of increasingly linked digital and physical contexts.
A system is accessible to whom? What gadget are they utilizing? What rights do they possess? Does the activity align with typical behavior? If a component is compromised, can the system still function? Is it possible to separate vital functions from compromised networks? These questions are equally important in a corporate network as they are in a military installation or an industrial control setting.
I have argued in earlier GovConWire work that Zero Trust is evolving from a relatively static security framework into a potentially dynamic security ecosystem due to AI and quantum computing. While AI can help with behavioral analytics, anomaly detection, continuous authentication, and predictive risk assessment, quantum-resistant cryptography will eventually be required to secure sensitive communications and data.
Therefore, safeguarding the network perimeter is not the only aspect of Zero Trust’s future. It involves building resilient systems where risk is continuously assessed for identity, devices, applications, data, physical assets and operational procedures.
The Battlefield Includes the Supply Chain
Defense Industrial Base and supply-chain resilience is another crucial aspect of FORTRESS America. Large and intricate networks of suppliers are essential to modern military capability. Manufacturers, software developers, logistics companies, subcontractors and technology vendors are examples of components that may span several legal jurisdictions. A weakness that is buried deep within that ecosystem may eventually become a national security vulnerability.
Cybersecurity and industrial policy are coming together more and more in this area. Because supply chains provide adversaries with opportunities to undermine trusted relationships instead of directly attacking the ultimate target, they have become prime targets. A compromised software update, supplier, component, or service provider may have a domino effect on several different organizations.
Adding another cybersecurity appliance is not the solution. Increased supply chain visibility, improved vendor risk management, software and hardware provenance, Software Bills of Materials, ongoing monitoring, diversified sourcing and backup plans for essential components are all necessary for the government and defense sector. Before they develop into national security emergencies, single points of failure must be found.
The larger public-private partnership also becomes essential in this situation. The private sector owns and runs about 85% of America’s vital infrastructure. The government cannot independently secure every piece of infrastructure that the nation depends on, but it can set standards, provide intelligence, develop technologies and coordinate national responses.
Therefore, FORTRESS America will be most effective if it is implemented outside of the Pentagon’s physical walls and establishes systems for long-term collaboration with business, utilities, telecom companies, technology firms, state and local governments and other infrastructure providers.
Spectrum & Space Can’t Be Ignored
Another crucial component of the FORTRESS framework is the incorporation of space and spectrum resilience. Satellites, positioning, navigation, timing and electromagnetic spectrum access are all crucial to modern military operations. Many of the same skills are becoming more and more important for civilian infrastructure.
Logistics, financial transactions, transportation, emergency communications and military operations are all supported by GPS, satellite communications, timing services and wireless networks. It is not necessary for an adversary to destroy a satellite in order to cause disruption if they are able to interfere with those capabilities. The services that modern society and military forces rely on may be compromised by jamming, spoofing, cyber intrusion and electromagnetic interference. Redundancy, hardening, alternative positioning and navigation capabilities, robust communications and the capacity to function under challenging circumstances are all necessary components of the solution.
This is yet another illustration of the value of the FORTRESS concept. Instead of focusing only on asset protection, it considers national security from the perspective of mission continuity. The distinction between “How does the mission continue if the satellite becomes unavailable?” and “How do we protect the satellite?” is crucial to resilience.
The Return of Redundancy and Strategic Reserves
The development of strategic defense reserves, FORTRESS America’s fifth pillar, may end up being just as significant as the initiative’s technological components. Efficiency has frequently taken precedence over redundancy for decades. Just-in-time delivery, minimizing inventories and cutting excess capacity are the main goals of global supply chains. While this model can function incredibly well in normal circumstances, it can become hazardous in times of crisis.
As evidenced by pandemics, wars, natural disasters, cyberattacks, geopolitical tensions and supply-chain disruptions, resilience occasionally necessitates preserving capacity that seems inefficient until it becomes essential. That buffer can be supplied by strategic reserves.
Energy production, communications, manufacturing, logistics and technological components are all subject to the same principle. Both reliance on a single point of failure and redundancy have costs. Therefore, the cost of redundancy should not be the only factor in the actual calculation. When redundancy is absent, it ought to be the price of national failure.
From Operational Resilience to Reactive Defense
The potential for FORTRESS America to influence the way the federal government views infrastructure security may be its most significant feature. Cybersecurity policy has been reactive for far too long. When a vulnerability is found, a patch is released. When an attack takes place, an incident response team is called in. When a supply-chain breach is made public, businesses start looking into their suppliers.
That cycle won’t be enough to combat adversaries who employ sophisticated intelligence operations, automation, cyber-physical tactics and artificial intelligence. The idea of protecting individual systems must give way to one of building resilience into national capabilities from the start.
This entails carrying out practical stress tests. It entails determining interdependencies prior to a crisis. It entails being aware of what occurs when a supplier vanishes, an operational network is compromised, GPS deteriorates, communications are interrupted, or electricity is unavailable.
It entails creating systems that can fail gracefully as opposed to catastrophically. This same evolution is reflected in CISA’s recent emphasis on critical infrastructure isolation and recovery capabilities: rather than relying solely on prevention, organizations must be able to maintain critical services both during and after a cyberattack. That idea can be expanded to a higher level of national security by FORTRESS America.
The Possibility: Construct a National Architecture for Resilience
Defending military installations is only one aspect of the ultimate opportunity. A more comprehensive national resilience architecture that links the security of military installations with the civilian infrastructure that both those installations and the American economy rely on could be modeled after FORTRESS America.
This does not imply that vital infrastructure should be militarized. It entails acknowledging interdependence as a reality. Without dependable electricity, a military installation cannot continue to function. Without telecommunications, the reliable delivery of electricity is impossible. Space and spectrum are becoming more and more important to telecommunications.
These systems are all reliant on supply chains, software and hardware. Furthermore, supply chains ultimately rely on human expertise, manufacturing, transportation and financial systems. Therefore, rather than being a collection of discrete sectors, the national-security ecosystem is a web. For this reason, a comprehensive program like FORTRESS America is crucial. Another set of disparate cybersecurity initiatives is not necessary for the United States. It requires a workable framework for determining the most important dependencies for the country, ranking the risks and funding the resilience needed to maintain vital missions under pressure.
Government, business and academia should collaborate on this. It should integrate cutting-edge technologies like artificial intelligence, quantum computing, advanced sensing, autonomous systems and resilient communications—but with security built in from the start. It should also acknowledge that technology is insufficient on its own. Equally crucial elements of resilience include people, procedures, governance, training, procurement policy and leadership.
A Realistic Defense of America’s Top Priorities
The operationalization of FORTRESS America is still ongoing, and its success will ultimately depend on how well it is carried out. Directives, strategies and program offices are just the start. Converting the idea into quantifiable improvements at installations, in supply chains, across energy systems and throughout the larger national-security ecosystem will be the challenging task.
This entails setting definite priorities. It entails assessing resilience as opposed to just compliance. It entails locating crucial dependencies and getting rid of single points of failure. It entails integrating supply-chain security, energy security, cybersecurity, physical security and communications resilience into a single risk discussion. Additionally, it entails developing systems that allow the public and private sectors to exchange information and collaborate in response to emerging threats.
The strategy’s apparent impressiveness won’t be the most crucial test for FORTRESS America. It will depend on whether an enemy can cause a disruption and learn that the US can withstand the shock, continue vital operations and bounce back quickly. That is what resilience is all about. The presumption that our vital systems will never malfunction cannot be the foundation of America’s national security. It must rely on our capacity to foresee dangers, endure disruption, carry out crucial tasks and bounce back more powerfully.
FORTRESS America has the potential to be much more than just another Pentagon project if it is carried out with that goal. It might offer a crucial framework for filling in some of the most significant holes in the defenses of America’s vital infrastructure and constructing a more robust, redundant and integrated national security base.
That kind of all-encompassing approach is becoming more than just desirable in a time when cyberattacks, physical attacks, supply-chain disruptions, energy vulnerabilities, space threats and emerging technologies are all coming together.
