The Cybersecurity and Infrastructure Security Agency (CISA) on Oct. 26 released a strategy that calls for proactively eliminating adversaries’ footholds in critical infrastructure and concentrating resources on systems whose disruption would have the most severe consequences for national security, the economy, and public safety.
The CISA 2030: Defend, Harden, Prevail strategy outlines an operational shift toward intelligence-driven defense, closer coordination with infrastructure owners and operators, and greater capacity to sustain essential services during attacks. CISA will begin reviewing its core services and capabilities within 60 days and deliver an implementation and measurement approach within 180 days, according to the strategy.
Following its initial program review and implementation approach, CISA will report on progress within 365 days.
“CISA 2030 provides a focused roadmap to strengthen defenses, eliminate adversarial footholds, and deny them any advantage that could endanger the nation’s security, economy, or public health,” said Nick Andersen, CISA’s acting director, in the announcement.
The strategy is organized under three pillars:
- Defend: Lead national defense
- Harden: Prioritize national infrastructure security
- Prevail: Mobilize national resilience
Strengthening cyber defense and software security
Under its cyber defense pillar, CISA plans to integrate capabilities across government, industry, state, local, tribal, and territorial partners, and international organizations to improve understanding of threats and reduce cyber risk.
Operational technology security is a central objective. CISA will work with critical infrastructure owners and operators to modernize those environments, improve asset visibility and anomaly detection, and strengthen supply chain integrity.
The agency also plans to develop data-driven guidance and best practices with partners to improve software security and supply chain transparency. Additional work will focus on assessing and rapidly deploying emerging technologies that improve cyber defense and communications continuity while addressing the risks those technologies introduce.
Focusing resources on the most consequential risks
The strategy calls for deprioritizing “threat-agnostic, all-hazards approaches” and focusing resources on infrastructure whose disruption would have the greatest consequences for public safety, economic continuity, and national security.
That approach will direct attention, investment, and operational efforts toward infrastructure whose failure would most affect public health and safety, economic continuity, and national security.
CISA plans to coordinate with the intelligence community, industry, and government agencies to improve the flow of intelligence into operational decisions. The strategy calls for targeted investments in tools that support real-time decisions and alerts, along with faster operational responses.
The agency also will analyze infrastructure data to guide resource allocation and support the White House in developing a National Risk Register that identifies and quantifies infrastructure risks.
Building resilience and communications continuity
The resilience pillar emphasizes regional capabilities, local expertise, and distributed partnerships. CISA plans to build capacity through its 10 regional offices and equip its advisors to help communities address cyber and physical security risks.
Emergency communications are another priority. The agency plans to expand priority telecommunications services using capabilities including 5G/6G and commercial satellite constellations to provide resilient, redundant connectivity.
CISA also will use advanced analytics, emerging technologies, intelligence, and cross-sector collaboration to assess readiness and modernize planning and exercises. The strategy calls for investment in scalable, encrypted infrastructure that supports coordinated operations and continuity of essential functions during disruptions.
CISA said the strategy advances the Cyber Strategy for America and National Resilience Strategy.