Establishing a cyber safety standard of care for the built environment.
Cyber-physical risk takes center stage.
For decades, cybersecurity was treated as a technology problem: stolen data, ransomware, disrupted business systems. The 2026 Cyber Safety Summit made a different case. Today's threats increasingly target the systems that control the physical world.
Hosted at the National Academy of Sciences and supported by Building Cyber Security, the National Academy of Construction and the Society of American Military Engineers, the summit convened leaders from government, engineering, cybersecurity, insurance and academia around a single theme: cyber-physical risk.
01 / 06
The threat has moved into the physical world.
After a welcome from the National Academy of Engineering and recognition of sponsors, the morning opened with a national threat intelligence briefing, followed by a federal agencies panel with the Office of the National Cyber Director, CISA, DOE and NSC on the cyber defense of critical infrastructure. Nick Andersen, acting director of the Cybersecurity and Infrastructure Security Agency (CISA), described adversaries increasingly focused on infrastructure and operational technology, likening today's cybersecurity practices to medicine before professional standards existed, an era of elixirs and tonics.
“We are asking the American public to live with a tremendous amount of risk that I don't think they realize,” he said. Speakers warned that adversaries are pre-positioning inside critical systems, and that artificial intelligence is lowering the barrier to entry for attackers.
Nick Andersen, acting director of CISA, with Lucian Niemeyer, CEO of Building Cyber Security and former assistant secretary of defense.
02 / 06
Not only nation-states.
Two mid-morning panels followed: national asset owners on their programs to protect operational technology, and the Nation's leading architecture and engineering firms on cyber safety engineering capabilities. Participants noted that criminal groups chasing financial gain often cause unintended operational consequences, disrupting public services even when the goal was purely economic.
For boards and executives, the message was direct: cyber incidents can no longer be viewed only through the lens of data and reputation. They now affect operations, safety and public trust.
Photo: Brian May, moderator, with David Brearley, HDR
03 / 06
An insurance problem without precedent.
Insurance leaders shifted the conversation from threats to consequences. Gerry Kennedy, CEO of Observatory Strategic Management, noted that insurers have spent decades modeling hurricanes, earthquakes and wildfires, events largely bound to one region. Operational technology is different: a single vulnerability can exist across thousands of facilities at once.
“Never in the history of insurance have we ever seen this level of aggregation of risk,” Kennedy said. One event could trigger losses across cyber, property, business interruption, professional liability, workers' compensation, environmental and directors and officers coverage simultaneously.
Photo: Gerry Kennedy, CEO of Observatory Strategic Management.
04 / 06
Concentration, coverage and long-lived assets.
Sezaneh Seymour of Coalition observed that property insurers would never knowingly insure every house on one beach, yet cyber portfolios often depend on the same technologies, platforms and providers. Steven Schwartz of FireTower Risk Solutions noted that property policies frequently exclude cyber-attacks: “A lot of the market is not covering the exposure today.”
Nicholas Leiserson of the Institute for Security and Technology added that decisions about connectivity and remote access made today will shape risk, and liability, for the decades-long life of the infrastructure.
Photo: Steven Schwartz of FireTower Risk Solutions, Sezaneh Seymour of Coalition and Nicholas Leiserson of the Institute for Security and Technology.
05 / 06
A governance issue, not an IT ticket.
Cyber-physical risk cuts across organizational silos. IT teams lead most cybersecurity programs, but operational technology often sits with facilities, engineering, operations or safety. Shaun Six, President of UTSI International, urged organizations to prioritize risk mitigation over risk transfer: insurance matters, but it doesn't reduce exposure before an incident.
Photo: Tatiana Bolton, Monument Advocacy, Shaun Six, UTSI International and Allison King, Forescout
06 / 06
Toward a standard of care.
The afternoon turned to action. A moderated town hall asked what a Cyber Safety Standard of Care requires, followed by three academic white papers selected by the executive committee. Facilitated break-out sessions then formed action groups around five topics: defining cyber safety in the built environment, standards of reasonable care, requirements for a professional license, updates to engineering examinations, and engineering applications and best practices for engineering and construction.
Summit organizer Lucian Niemeyer noted that architects, engineers and builders already carry professional liability and builders' risk coverage, and that the conversation must now extend to the cyber risk inherent in those roles.
A closing town hall set next actions for the new working groups, and the day ended with a reception.
Photo: Lucian Niemyer, Moderator, Chuck Brooks, Brooks Consulting International, Brian Correia, Sans, and Matthew Jablonski, George Mason University
Cyber-physical risk is no longer only a cybersecurity issue. It is an operational issue, a resilience issue and, increasingly, a governance issue.
With thanks to those who made 2026 possible.
A day of collaboration on cyber safety standards.
For engineering, construction, and facility management professionals.
Recognition of sponsors.
With Mr. Nick Andersen, Acting Director of the Department of Homeland Security's Cybersecurity and Infrastructure Security Agency (CISA).
Senior experts from the Dept of War, the National Security Agency, and USCYBERCOM will discuss the expanding risk to national security from cyber attacks and targeting of the connected operational technologies in critical infrastructure that society relies on for existence.
Asset owners assume that the projects they commission from the engineering and construction industry will be safe for human interaction. Global engineering degree curriculums, professional licensing administered by States, and annual professional education requirements are intended for a project's designers of record to incorporate standards of care, building codes, and industry best practices for human safety. Should owners be adequately informed of the expanding cyber threats that threaten human safety in their assets, or should that awareness be an engineering responsibility? We'll share the experience and expertise of professional engineers who are practicing cyber security engineering today.
The relationship between insurance and professional engineering standards of care is highlighted usually when major engineering failures (fires, bridge collapse, boiler explosions) lead to significant loss of lives/property and resulting liability issues. Professional engineering societies have developed codes of ethics and practice standards in part to address public safety failures and insurance market concerns. Engineering firms want professional liability insurance while insurers require predictable professional behavior, defensible norms of practice, and evidence that engineers adhered to accepted standards of care. How can insurance and engineering standards organizations come together to identify the norms of practice for the safe design and construction of automated systems to mitigate the risk to life and property?
Just as the built environment is increasingly engineered with new digital technologies to connect systems for improved effectiveness, automation, and efficiencies, the engineering of protections from cyber exploitation should be included to enhance human safety. A Standard of Care and professional development requirement for cyber security engineering must include updated expertise in the range of new processes, techniques, and applications being developed by industry leaders committed to reducing cyber risks for operational technologies. This panel will discuss how commercial innovation can be incorporated into curriculums and professional education for engineers designing, specifying, constructing, and managing the life cycle of a built system.
Cyber-Informed Engineering (CIE) integrates cybersecurity considerations into the conception, design, development, and operation of any physical system to mitigate avenues for cyber-enabled attacks. Design decisions and engineering controls are prioritized to defend against the worst possible consequences of cyberattacks threatening human safety. How can we accelerate the implementation of CIE by establishing within the consequence management framework a subset of controls and protections that must be included by engineers to meet a standard for safe operation of the asset?
Asset owners and industry practices are increasingly incorporating innovative technology stacks, automated processes, and autonomous devices in the engineering of the built environment, from buildings and infrastructure to transportation, healthcare, and robotics. The engineering responsibilities for the safe and secure design of these connected systems to preclude cyber exploitation have traditionally rested within the traditional disciplines. As technology stacks become more sophisticated, including connected technologies introduced by owners, the traditional disciplines can be overwhelmed. We'll discuss the development of a cyber safety engineering curriculum, the requirements for professional licensure, and how the engineering profession can benefit from establishing a cyber safety engineer as a recognized designer of record. We'll also discuss the existing training programs already established for professional development credits over a cyber safety engineer's career.
Auditorium.
Auditorium.
Auditorium.
Technical papers that strengthen cyber safety in critical infrastructure.
The summit featured academic white papers showcasing leading approaches to cyber safety, selected by the executive committee and presented to the full assembly.