Dayton, Ohio Correspondent — Most critical infrastructure is owned privately or by states and localities, which is the fact that determines what the federal role can actually be.

Clear performance standards, better threat information sharing, targeted support for upgrades. Cyber requirements can go into existing sector regulators and procurement rules rather than into a new organization.

Additional layers slow response and diffuse accountability. Use the authorities on the books and measure outcomes instead of publishing organizational charts.

Novi, Michigan Correspondent — Baseline standards, rapid threat sharing, procurement and financing incentives.

The procurement lever is the underrated one. When a large buyer requires something, the supply base delivers it in about eighteen months, and it does so without a rulemaking. We’ve watched that work in automotive on quality standards that no regulator ever wrote.

Sydney, Australia Correspondent — Standards, information sharing, and targeted investment produce more reliability than additional organizational layers.

One structural point. We legislated critical infrastructure obligations and the hardest part wasn’t the standard. It was defining which assets were in scope, because every operator wanted out and every regulator wanted everything in.

Get the scope narrow and defensible. A short list that’s enforced beats a long list that becomes a compliance ritual.

Gastonia, North Carolina Correspondent — Standards, fast threat information, and money for upgrades beat a new permanent agency.

I’d apply the test I use on a manuscript. If you can’t say what the new body would do that an existing one is failing to do, you’re adding a masthead, not an editor.

Use what’s on the books. Hold somebody accountable for a result.

Cheyenne, Wyoming Correspondent — Use the agencies you have. Give asset owners a short list of standards that can actually be audited. Pay for the last mile on the rural line and the plant fence.

Don’t build a cathedral. Cathedrals produce guidance, and guidance doesn’t patch a pump.

Tyler, Texas Correspondent — I insure yards that already know their weak gate and their old controller. They don’t need a new organizational chart in Washington.

They need a standard that stays put for five years, a tax treatment that makes the upgrade rational, and a consequence when they ignore the obvious.

Cyber and physical are one problem on a site still running a default password and a padlock from 1996, and I’ve seen exactly that combination on a facility that would make the news. If you add a layer, make it a funding window with a sunset rather than a career path.

Knoxville, Tennessee Correspondent — Utilities and counties can implement. They can’t implement a stack of overlapping circulars from four agencies that don’t read each other’s mail.

One playbook for the high-risk assets. Money that follows a completed item rather than a plan. Threat information that arrives before the incident.

I need a generator that starts and a control system that isn’t a museum piece. I have sufficient press releases.

Long Island, New York Correspondent — After Sandy we learned the physical file. The cyber file is the same lesson with a different tool — the asset you didn’t harden is the asset you write the claim on.

Federal role is standards, information, and cost-share. Federal role is not a seventh coordinating meeting.

Consolidate the meetings. Publish the standard. Pay for the retrofit.