CISA Unveils CISA 2030: Defend, Harden, Prevail

The Cybersecurity and Infrastructure Security Agency released CISA 2030: Defend, Harden, Prevail on Oct. 26, 2026, and Acting Director Nick Andersen called on owners and operators of critical infrastructure along with vendors and manufacturers to take action without delay.

In a foreword to the document, Andersen said the agency must act with renewed purpose. The strategy runs 10 pages and uses three pillars: Defend, Harden and Prevail. CISA will combine state, local and industry cyber defense, protect operational technology, issue software security guidance, and assess emerging technologies under the Defend pillar.

Under Harden, CISA will blend intelligence focused on critical infrastructure, review infrastructure data, cooperate with international partners, and press for stronger protection of the most important infrastructure. Under Prevail, CISA will pay for critical infrastructure resilience, improve national communications interoperability, refresh planning and exercises, and develop next-generation interoperable infrastructure.

CISA said it will replace passive defense with an aggressive, anticipatory approach to identify, mitigate and reduce malicious access to critical infrastructure. The agency said its operational approach means actively seeking adversarial access, ending it, and making critical infrastructure stronger against emerging threats.

The strategy gives priority to infrastructure most essential to national security, the economy, public health and safety.

CISA will begin reviewing core services and capabilities within 60 days to meet key objectives as part of the near-term implementation timeline. The agency will deliver an implementation plan and results measurement framework within 180 days as part of the mid-term implementation timeline. CISA will issue a progress report on strategy execution after one year as part of the one-year progress reporting requirement.

The previous CISA strategic plan from 2023 used three pillars: address immediate threats, harden the terrain and drive security at scale. The new strategy reaffirms existing CISA roles while maintaining continuity with current agency functions.

The strategy supports President Trump’s Cyber Strategy for America and the National Resilience Strategy. It follows the administration’s broader cyber strategy from March and last year’s executive order covering state and local preparedness.

CISA serves as the national cyber defense agency and coordinator for critical infrastructure security. Under a Department of Homeland Security delegation, CISA leads National Security and Emergency Preparedness communications initiation and restoration during crises.

CISA will work with public and private partners to strengthen operational technology security. The agency will advance software security, support secure emerging technologies and improve National Security and Emergency Preparedness communications continuity.

The strategy warns that cyber, physical and geopolitical threats now intersect and can disrupt essential daily services. Nation-state actors and other malicious adversaries are growing more sophisticated in attempts to compromise U.S. networks.

Critics say Trump administration budget cuts have badly diminished CISA and left it understaffed, including areas targeted by the new strategy. Security experts warned that 2025 Trump administration reductions to CISA affected work to secure critical election infrastructure.

Reports show CISA terminated federal funding for the Election Infrastructure Information Sharing and Analysis Center to save costs. The new election infrastructure security plan did not specifically mention the Election Infrastructure Information Sharing and Analysis Center.

On Sept. 3, 2026, Senator Alex Padilla and Representative Joe Morelle published an open letter demanding immediate restoration of Election Infrastructure Information Sharing and Analysis Center funding before the 2026 midterms.

CISA and Five Eyes partners are evaluating how well organizations can isolate and recover systems to inform upcoming recovery guidance. Matthew Springer said, “We are doing assessments currently on the ability of partners to isolate and recover,”

CI Fortify, a CISA initiative launched in May, will carry the recovery guidance to help critical infrastructure sustain essential services during large-scale cyber attacks and geopolitical crises. CI Fortify aims to preserve a minimum viable set of operations during a cyber incident.

CI Fortify covers isolation and recovery, including situations where internet, phone, cloud or third-party services go down. The recovery guidance will build on July guidance from CISA and partners focused on isolating vital systems.

CISA officials said operators must test isolation and recovery plans before an incident occurs. Officials urged organizations to identify suppliers, customers and partners they depend on and address those relationships before a crisis hits.

Organizations can begin with small tests, such as checking employee communication through backup methods during an outage.