CISA's Cyber Storm X Exercise Practiced Response to a Simulated Attack on Transportation and Water Systems

In a release dated September 18, 2026, CISA announced it had hosted Cyber Storm X, described as a four-day national cybersecurity exercise and the tenth in the twenty-year history of the Cyber Storm program. The agency stated the exercise drew participants from across public and private sectors. Acting CISA Director Nick Andersen was quoted in the release framing the exercise's purpose as helping critical infrastructure owners and operators understand how a large-scale cyber incident would be managed, and as a way to strengthen national resilience by testing whether plans, policies, and partnerships are ready.

According to the release, this year's simulated scenario involved a nation-state adversary targeting the transportation systems sector, including rail and ports, along with the water and wastewater systems sector. CISA stated that participants used the exercise to test response plans, practice coordination, and strengthen information sharing in what the release called a safe environment, with over two hundred organizations across government and the private sector involved. The release is an announcement of the exercise having occurred; it does not describe specific outcomes, findings, or performance results from the exercise itself.

Consider how your own organization would handle a hypothetical practice scenario modeled on the one CISA described, involving coordinated disruption across interdependent sectors. Who within your organization would be responsible for contacting external partners or government counterparts during such a scenario, and how would that handoff be documented? If a transportation or water-sector partner reported a disruption, would your team know which internal plan or playbook to activate first, and who would decide when to escalate to leadership? These are useful questions to walk through independent of whether your organization has ever participated in a formal exercise.

This announcement establishes that CISA hosted a simulated exercise with a defined scenario and stated goals, and that it planned to work with participating organizations afterward to identify lessons learned, which it said it would use in a public after-action report. It does not establish that any specific vulnerability was found, that coordination succeeded or failed, or what the after-action report ultimately concluded, since this is a single dated source describing the exercise's launch and scope rather than its results.

Key takeaways

CISA stated Cyber Storm X was a four-day exercise simulating a nation-state attack on transportation and water/wastewater sectors, not a real incident.

The release describes the exercise's scope and purpose but does not report outcomes; CISA said it planned a future after-action report.

Editorial recommendations

Document who would contact a partner organization during your own practice scenario.

Evidence and limitations

One dated primary source; no independent verification.

Sources

Primary source