CISA Unveils 2030 Strategy to Bolster Cyber Defenses

"The threat landscape we face today is not static," Acting CISA Director Nick Andersen wrote in a foreword to a new agency plan released Monday. The Cybersecurity and Infrastructure Security Agency’s 10‑page strategy, titled CISA 2030: Defend, Harden, Prevail, lays out a four‑year orientation for the agency and a compact timeline for near‑term action.

CISA 2030: scope, schedule and stated purpose

The document restates CISA’s central role in national cyber defense and frames resilience as the organizing principle. Andersen wrote that “resilience must be the foundation of our approach,” quoting the president, and argued the agency must be ready to “detect [adversaries] quickly, evict them decisively, and keep critical operations running without interruption.” The strategy commits CISA to a rapid internal review: examine core services and capabilities within 60 days, begin implementation over the following 180 days, and publish an update on progress after one year.

Defend: lead national cyber defense — core objectives

Under the “Defend” pillar, CISA lists four key objectives. The agency will seek to integrate state, local and industry cyber defense; protect operational technology; develop guidance and best practices on software security; and assess and develop emerging technologies. Those aims are positioned as part of CISA’s effort to “lead national cyber defense” and to remove adversarial footholds before they can endanger critical operations.

Harden: prioritize national infrastructure security — coordination and analysis

The “Harden” pillar emphasizes securing the nation’s most important infrastructure. CISA identifies objectives to coordinate intelligence for critical infrastructure, analyze infrastructure data, work with international partners, and emphasize strengthening the nation’s most important infrastructure. The language stresses both information sharing and prioritization of scarce protective resources toward high‑value assets.

Prevail: mobilize national resilience — communications, exercises and modernization

“Prevail” centers on resilience and continuity. Key objectives include investing in critical infrastructure resilience; strengthening national communications interoperability; modernizing planning and exercises; and building next‑generation interoperable infrastructure. Andersen’s public comment accompanying the strategy explicitly calls on “every company and organization in the critical infrastructure community — from owners and operators to vendors and technology manufacturers — to act now.”

What this means for owners and operators, vendors and technology manufacturers, and state and local governments

• Owners and operators: CISA’s stated priorities put operational technology protection and investment in resilience squarely on their plates. The agency’s drive to integrate state, local and industry cyber defense implies expanded coordination expectations and potential prioritization in analyses and protective efforts.
• Vendors and technology manufacturers: The strategy highlights development of guidance and best practices on software security, signaling that vendors are a target audience for new standards, guidance, and assessments tied to the agency’s software‑security objective.
• State and local governments: The strategy is explicitly aligned with the administration’s March broader cyber strategy and last year’s executive order on state and local preparedness, indicating CISA plans to fold state and local readiness into its national posture and to use the review and implementation timelines to affect preparedness activities.

Context and criticism: staffing, funding and continuity with prior plans

Critics cited in the release argue that CISA has been “badly diminished by budget cuts at the agency by the Trump administration,” and say those cuts have left it understaffed — a critique that is particularly pointed because the new strategy elevates functions reportedly affected by those same reductions. The agency’s previous strategic plan, published in 2023, also used a three‑pillar structure — “address immediate threats, harden the terrain and drive security at scale” — a continuity of framing even as the 2030 plan rebrands and recasts objectives around defend, harden and prevail.

The new strategy is explicitly tied to broader administration policy: it is described as aligning with the administration’s broader cyber strategy published in March and with last year’s executive order on state and local preparedness. Andersen’s repeated public calls for private‑sector action underscore that CISA envisions a distributed response, with government and industry both responsible for strengthening defenses and denying adversaries advantage.

The document sets a clear clock — 60 days for review, 180 days to start implementation, and a one‑year progress update — and leaves at least one concrete question hanging from the facts on the page: can CISA complete those reviews and meet implementation milestones while addressing the staffing and budget concerns critics have raised? The agency’s first progress update, due in roughly a year, will be the first measure of whether CISA’s stated timetable matches its capacity.

https://cyberscoop.com/cisa-2030-cybersecurity-strategy/