Cyber Storm X, which will be conducted in Fall 2026, is CISA’s tenth iteration of the biennial National Cyber Exercise. Cyber Storm X will provide participants the opportunity to examine their response to an adversary-driven cyberattack, identifying ways to improve their organizations’ and the nation’s cybersecurity preparedness.
Advancing National Cyber Resilience
As cyber threats grow in scale and sophistication, our nation must continually refine its cyber incident response capabilities. Building on insights from past iterations, Cyber Storm X will explore the full spectrum of cyber incident response by simulating an adversary-driven cyberattack on critical infrastructure. The exercise will enable participants to test internal response plans while strengthening coordination across federal, state, local, and private sector partners. Through active partnership, stakeholders will identify capability gaps, reinforce existing strengths, and develop actionable strategies to advance the nation’s overall cyber resilience.
Cyber Storm X Quick Facts
Date: Fall 2026
Duration: 4 days of live play
Exercise Stakeholders
- Federal departments and agencies
- Industry-specific partners from critical infrastructure sectors (e.g., Transportation Systems and Water and Wastewater Systems)
- State and local governments
Cyber Storm X Participation
- Cyber Storm X will include organizations across federal, state, and local governments and the private sector.
- Participants are divided into working groups to support planning and collaboration among specific communities of interest.
- Benefits of participation include improving organizational response plans and capabilities, strengthening relationships with counterparts, and increasing awareness of resources available to respond to and mitigate impacts.
Cyber Storm X Goal and Objectives
Cyber Storm X’s primary goal is to strengthen cybersecurity preparedness and response capabilities by exercising policies, processes, and procedures for identifying and responding to a multi-sector significant cyber incident impacting critical infrastructure.
Cyber Storm X specific objectives are to:
- Explore the challenges of cyber incident response, emphasizing real-world threats
- Examine and clarify roles and responsibilities in response to a significant cyber incident
- Assess information sharing capabilities and resource needs during a cyber incident
- Increase understanding of current national-level cyber plans and policies
Past Highlights
Each Cyber Storm builds on lessons learned from previous real-world incidents, ensuring that participants face more sophisticated and challenging exercises every two years.
Contact
For additional information on Cyber Storm exercises, contact cyberstorm@cisa.dhs.gov.
