Critical Infrastructure

The Department of War selected Nokia Federal Solutions for a RAPID contract to develop and demonstrate integrated sensing and communications using commercial 5G and future 6G infrastructure. Nokia’s individual award amount was not disclosed; the contract is one of 11 awards sharing a $50 million program-wide pool, not an open solicitation.

Experts warned that Iranian-affiliated actors may target U.S. water, energy, government, healthcare, and business systems. Microsoft attributed its November 12 Microsoft 365 outage to infrastructure and server problems, not a confirmed cyberattack; the warning points to resilience priorities but identifies no new procurement, funding, or award.

VulnCheck disclosed 14 vulnerabilities in Copeland/Dixell XWEB EVO refrigeration supervision systems; lab testing found each could enable root or administrative access, and at least two are reportedly being actively exploited. Government facility operators and contractors should identify exposed and legacy systems, remove them from the public internet, and apply available patches.

A White House AI task force urged regulators to consider at least 12 months of liability flexibility for organizations that voluntarily report cyber incidents in good faith, citing AI-driven threats and potentially outdated standards. The recommendation is not binding policy or a procurement announcement; contractors should track it separately from CISA’s forthcoming incident-reporting rule.

DataM Intelligence projects the global Zero Trust security market will grow from **US$47.84 billion in 2025** to **US$196.93 billion by 2035**, with identity-first protection, cloud security, and continuous verification driving adoption. The forecast and cited government guidance offer market-research context for agencies and contractors, but identify no specific solicitation, award, or funding.

French authorities attribute destructive attacks on refrigeration controllers at more than 700 supermarket locations to an Iranian cyber unit; U.S. authorities also suspect Iran. The incident highlights potential demand for OT security assessments, incident response, and resilient control systems, but no solicitation or contract has been identified.

DOE’s AI-FORTS program is advancing research in AI-enabled threat detection, secure AI deployment, and testing in simulated critical-infrastructure environments. FY 2027 budget materials identify AI cybersecurity as a planned R&D investment, but no solicitation or award is reported; C2E2 cites 95% threat-detection accuracy and faster data preparation.

The Department of Defense’s Office of Strategic Capital conditionally committed $450 million in loans to Rocket Lab, Stoke Space, and LeoLabs for launch capacity and space-monitoring infrastructure. The financing is not a contract award or solicitation, and the commitments remain subject to due diligence, closing conditions, and matching company capital.

A Security Magazine article forecasts possible post-midterm action on cyber information-sharing reauthorization, CISA capacity and state-local grants, and more coordinated supply-chain requirements. No policy change, funding, or solicitation is confirmed; contractors should treat the developments as planning signals and assess their fit for potential future demand.

CISA circulated an internal framework on November 5 to help leaders assess cyber and infrastructure risks, identify decision-critical information, and coordinate preparedness and response. Divisional implementation guidance is expected in the coming months, but no solicitation or contract opportunity has been announced.

President Donald Trump has nominated Palantir Chief Information Security Officer Michael LoSapio to lead CISA, which has lacked a Senate-confirmed director since January 2025. Confirmation timing is uncertain, and the leadership transition could affect agency priorities, oversight, staffing, and service reviews—but no contract or procurement action is announced.

Sen. Raphael Warnock and Rep. Hank Johnson asked the EPA to strengthen monitoring and oversight of diesel generators used for data center backup power, citing health risks and limited federal oversight. Their request is not a regulation, but any EPA response could affect data center permitting, operations, and demand for emissions-control and monitoring services.

FEMA has made $250 million available to states for counter-UAS capabilities protecting critical infrastructure and major public events, with applications due November 16, 2026. Contractors are not direct applicants, but state and local implementation may create demand for integrated sensors, shared airspace awareness, training, and equipment sustainment ahead of the 2028 Los Angeles Olympics.

CISA’s proposed CIRCIA rule was submitted to OIRA on October 1, 2026, and remains under interagency review—not finalized or in effect. Contractors should monitor the rule while assessing state breach-notification deadlines, incident-response readiness, supplier controls, and potential False Claims Act exposure.

Palo Alto Networks reports that two-thirds of vulnerabilities identified by frontier AI lacked CVE identifiers, while AI-enabled or autonomous attacks tripled and the fastest intrusions reached data exfiltration in 72 minutes. The findings may inform government and critical-infrastructure security requirements for rapid detection, response, and AI oversight, but identify no solicitation, award, contract, or procurement timeline.

A joint federal warning says internet-exposed and unpatched industrial refrigeration controls face ongoing cyber threats that could disrupt food, healthcare, transportation, and military cold chains. Operators face near-term inventory, audit, and controller-replacement deadlines, while emerging baseline standards may affect future equipment procurements.

Keeper Security announced Self-Managed Keeper, a self-hosted privileged access management product designed for government, defense, critical infrastructure, and other restricted or disconnected networks. The announcement is a product launch—not a solicitation or award—and provides no pricing, contract terms, or acquisition vehicle.

Billington CyberSecurity will convene government, military, infrastructure operators, and industry in San Antonio on November 17–18, 2026, to address connected-system cyber risks and resilience. The event offers contractors a venue to engage stakeholders on supply-chain security, cyber-informed engineering, and water-sector protection; government and military attendees may participate at no charge.

Crytica Security’s RDAi device-level operational technology threat-detection solution is now available to federal and state, local, and education buyers through Carahsoft’s reseller network, NASA SEWP V, and NASPO ValuePoint. The partnership creates an existing-vehicle purchasing path for agencies evaluating OT cybersecurity, but the announcement provides no pricing, contract value, solicitation deadline, or specific deployment requirement.

Thirty-five business groups are urging Congress to extend the Cybersecurity Information Sharing Act of 2015 through 2035 in the FY2027 NDAA. The House bill includes the extension, but the Senate bill does not; with protections currently scheduled to expire December 11, federal cyber contractors should assess exposure if negotiations do not produce an extension.

Japan plans to announce an emergency cybersecurity package by early November 2026 that would expand access to high-performance U.S. AI models for finding and remediating vulnerabilities in government networks and critical infrastructure. The move could create cross-border opportunities for AI and cybersecurity providers, but no solicitation, contract, or funding has been disclosed.

The **Department of Defense** is investigating freezer-control failures that spoiled food at about six U.S. military commissaries in August 2026 as suspected cyberattacks; neither the cause nor any responsible party has been confirmed. The incidents highlight operational technology risks in food storage, but no solicitation, award, contract value, or procurement schedule has been identified.

Canada’s first national security strategy in more than 20 years identifies frontier AI alongside cyberattacks, espionage, sabotage, and foreign interference as a major security risk. Its priorities may signal future demand for AI security, cyber defence, and intelligence modernization, but the strategy announces no solicitation, funding, or procurement timeline.

Rep. Rich McCormick introduced legislation directing NIST to update cloud security standards, including guidance on AI-based threat detection, device-linked identity protections, and third-party software monitoring. If enacted, the bill would align FedRAMP with revised standards and create a voluntary certification program, but it is not a procurement opportunity and specifies no funding or implementation timeline.

FERC’s Division of Dam Safety and Inspections Security Branch is briefing licensees and exemptees on annual security certifications, 2026 physical and cybersecurity inspection findings, and an unclassified threat assessment. Contractors supporting regulated dam operators can use the session to track compliance priorities, though no contract or solicitation is announced.

The **U.S. Marine Corps** is expanding its Unified Controls Resilience Network (UniCRN) approach to protect operational technology supporting essential installation services. The effort may point to future demand for OT cybersecurity and infrastructure resilience capabilities, but no active solicitation, contract value, or procurement contact is identified.

Parsons reported $5.75 billion in year-to-date awards and $7.6 billion in remaining unsatisfied performance obligations as of September 30, 2026, including $4.04 billion expected to be performed within one year. The figures offer potential teaming and subcontracting context across federal and infrastructure work, but do not signal that specific solicitations are open; two Remote Programs contracts are planned for transfer by year-end.

Researchers say China-linked Storm-2603 compromised at least four organizations, including a water utility, and used SharePoint access to disable security tools before deploying ransomware. The incident highlights procurement priorities for utilities: timely patching, resilient endpoint protection, Active Directory security, and controls that remain effective under attack.

CISA’s “Defend, Harden, Prevail” strategy directs the agency to review core services within 60 days, develop an implementation and measurement approach within 180 days, and report progress within 365 days. The shift toward operational technology security, consequence-based risk analysis, and resilient communications may shape future contractor requirements, but no active solicitation or contract value has been identified.

The Defense Intelligence Agency released the 2026 unclassified edition of *Challenges to Security in Space*, assessing adversary strategies and capabilities, dual-use systems, cooperation, and debris. The report offers market context for space-defense and intelligence contractors, but identifies no solicitation, award, funding, contracting vehicle, or procurement schedule.

ESET reported that Russia-aligned operators used the MythicRatatoskr backdoor and Yggdrasil mesh network to maintain access to a Ukrainian grain logistics company for 63 days before wiping domain-joined systems with Microsoft SDelete. The incident highlights defensive needs for agencies and contractors supporting critical supply chains, but identifies no solicitation, contract, or funded procurement opportunity.

The Army expects another Strategic Capital Initiative RFI round and has opened a live software review platform to vendors. USDA direction seeks to remove barriers to American seafood suppliers in federal food procurement, while NIST is accepting comments on a draft cybersecurity handbook through December 4, 2026.

Japan's Digital Agency issued a September 10, 2026 procurement notice for an FY2026 information-security audit of government-cloud operations. The opportunity targets assessment and assurance providers, arriving alongside new Japanese critical-infrastructure cyber standards and rising global zero-trust demand projected to reach $196.93B by 2035.

The UK government announced approximately £600 million for AI security, biosecurity, cyber defence, research, and related programs, including £60 million for AI research and procurement contracts. The package signals potential future demand, but provides no solicitations, award dates, or contracting contacts; the funding should not be treated as an open competition or an award.

Virginia Executive Directive 6 orders a statewide plan for preventing and responding to cyberattacks, strengthening critical-infrastructure resilience, and addressing AI-related risks. The Cyber Consortium and regular briefings with AI companies, researchers, and regulators may help surface future state needs, but the directive announces no funding, solicitation, contract value, or procurement schedule.

USTDA is funding a feasibility study and pilot of U.S. cybersecurity technology for Moldova’s state-owned Moldtelecom and a proposed security operations center. Moldtelecom selected Pythia International to assess network risks and demonstrate a pilot solution; no funding amount or timeline was disclosed, and the announcement is not an open solicitation.

A Federal News Network commentary warns that Iran-linked cyber activity increasingly targets U.S. critical infrastructure, the defense industrial base, subcontractors, and operational technology. It says NIST SP 800-171 controls can mitigate 68% of 130 mapped techniques, while appropriate monitoring can detect all 130—pointing contractors toward supply-chain, OT, and monitoring reviews rather than a new procurement mandate.

The U.S. Coast Guard’s NVIC 02-26 explains how covered maritime operators can meet cybersecurity requirements established under 33 CFR Part 101, Subpart F. Operators must designate a qualified Cybersecurity Officer, complete a risk assessment, and submit a Cybersecurity Plan by July 16, 2027; outside assistance is optional, and penetration testing is not required for initial submissions.

Niagara Power Transformer has broken ground on a more than $71 million Cheektowaga expansion expected to boost production capacity by 50 percent, retain 146 jobs, and create 73 positions. State and local incentives support the project, but the announcement identifies no open solicitation or contract award; suppliers may monitor potential private-sector opportunities tied to the facility’s growth.

CISA branch chief Lindsey Cerkovnik is leaving after nearly six years, creating a leadership transition across vulnerability response, industrial-control-system vulnerabilities, and the CVE Program. A 2025 contract extension prevented a potential CVE data-flow interruption, but no new solicitation, contractor, contract value, or replacement official has been identified.

At the 7th U.S.-ASEAN Cyber Policy Dialogue, the United States and ASEAN members reaffirmed cooperation on cyber strategies, incident information sharing, cybercrime, scams, and critical infrastructure protection. The statement identifies policy priorities—not a contract, funding opportunity, solicitation, or procurement timeline.

CISA, the FBI, the U.S. Secret Service, and international partners report that SafePay has affected about 600 organizations worldwide since August 2024, including critical-infrastructure operators. Contractors should review the advisory’s indicators and mitigations, urgently patch cited Cisco, Veeam, and SonicWall vulnerabilities, and assess protections for remote access, networks, and backups.

The proposed AI Cyber Defense Act would direct NIST to develop voluntary guidance against AI model distillation attacks and convene government and industry stakeholders on critical-infrastructure cybersecurity. It does not authorize funding or create a procurement mandate, but could give AI security providers and federal contractors a forum to contribute expertise if the bill advances.

Dispel and Tenable have integrated Tenable One OT Exposure intelligence with Dispel’s Zero Trust Engine to inform industrial remote-access decisions in real time. Available to joint customers across cloud, on-premises, and hybrid environments, the commercial offering is not a government award or solicitation but may inform OT cybersecurity requirements and market research.

The U.S. Department of Energy advanced Eos Energy Enterprises $87 million to reimburse eligible costs for its second zinc-battery production line in Warrendale, Pennsylvania. The draw under an existing loan facility is not a new solicitation; Line 2 entered commercial production in June 2026 and is ramping toward 2 GWh of annual capacity.

The DOJ and FBI have seized seven domains linked to cyber activities of China's Integrity Technology Group. This action underscores ongoing national security risks for critical infrastructure, prompting contractors to reassess cybersecurity measures and capabilities.

A recent report indicates nearly 90% of state CIOs prioritize cybersecurity for critical infrastructure. With states boosting support to municipalities, there's a rising demand for cybersecurity services and assessments, highlighting potential procurement opportunities.

Federal agencies are warning over 100 water utilities nationwide about cybersecurity vulnerabilities. This situation presents significant procurement opportunities for cybersecurity firms specializing in protecting critical infrastructure, particularly for systems exposed to the internet.

The Cybersecurity and Infrastructure Security Agency (CISA) released an advisory revealing vulnerabilities in federal cybersecurity efforts following red team exercises. The report highlights the need for improved incident response and cloud security practices within federal agencies and contractors, signaling potential shifts in procurement requirements.

The **NIST** has unveiled critical cybersecurity guidance aimed at resource-constrained operators of Building Automation and Control Systems (BACS). This guidance is set to create procurement opportunities for contractors specializing in **OT** cybersecurity, emphasizing the need to address vulnerabilities in critical infrastructure components.