Cyberattacks are one of the greatest threats facing the country. In an increasingly digitized world, an almost limitless number of potential targets compounds this danger. Criminals seek to exploit cyber vulnerabilities by targeting individuals, businesses, and the public sector, including our federal government.

In fact, approximately 11% of cybersecurity incidents last year involved the public sector. Governments at the federal, state and local level are top targets. Unfortunately, we are unprepared and must do more to protect our institutions and build a culture of cyber resilience.

It’s not all gloom. Recently, Congress took encouraging steps. By now, most folks should know that the bipartisan Infrastructure Investment and Jobs Act (IIJA), enacted in November, is the largest infrastructure bill in a generation and the largest climate bill ever. What people may not know is that it also invests billions of dollars in fortifying our nation’s cybersecurity infrastructure. Over a billion dollars goes toward the new State, Local, Tribal and Territorial (SLTT) Grant Program, which will ensure every level of government is prepared to respond to the cyber threats of tomorrow.

As a part of this historic legislation, Congress also established the $100 million Cyber Response and Recovery Fund to allow our nation to respond to cyber attacks with the same fervor as FEMA responds to natural disasters. And for the first time, the IIJA provides sorely needed funds for the Office of the National Cyber Director, an office and position created in response to growing cyber attacks such as Solarwinds.

These are all positives, but there’s more to be done. The country should look no further than right here in Colorado to see what else needs doing.

Colorado has led the way on cybersecurity in recent years, largely by investing in public and private sector critical cybersecurity efforts. In 2016, Colorado stood up the Governor’s Cybersecurity Council to develop a comprehensive cybersecurity policy, minimum requirements and goals. The Council also coordinates with Colorado’s legislature and judiciary on critical cybersecurity issues.

And earlier this year, Gov. Jared Polis signed into law HB21-1236, aimed at better equipping our law enforcement agencies to go after cyber criminals. The law streamlines information sharing between the Colorado Cyber Operations Center and law enforcement partners to help investigate cybercrimes.

Colorado also has another powerful asset in our at-home National Cybersecurity Center (NCC). The National Cybersecurity Center, based in Colorado Springs, supports state and local elected leaders in making responsible budget, resource-allocation and policy decisions necessary for cyber preparedness and resiliency. NCC’s marquee Cyber for State Leaders program, supported by Google, briefed and trained more than one thousand elected leaders across the country in 2021 alone.

We visited NCC together last year, shortly after high-profile ransomware attacks against JBS USA and the Colonial Pipeline. We were impressed by NCC’s commitment to strengthening our defenses against cyberattacks by working with every level of government. Indeed, the NCC’s Cyber Resource Center also focuses on local cities and towns, with preventative education and support to defend against ongoing cyber threats. That’s exactly the approach we’ll need to overcome this 21st-century threat.

By collaborating at all levels, Colorado’s cybersecurity leadership is helping build a safer future for our digital world. But cyberspace doesn’t stop at the state line. We have to build our cyber defenses nationally. Congress should continue its work by looking to Colorado’s example to make sure our critical infrastructure is protected from catastrophic attacks in the future.

John Hickenlooper represents Colorado in the U.S. Senate. John Suthers is mayor of Colorado Springs.