“It is not a matter of if, it is a matter of when,” said CISA’s Brian Harrell, citing “moral responsibility” to protect citizens.