The Cybersecurity and Infrastructure Security Agency (CISA), the federal agency that coordinates protection of the nation's critical systems, released a four-year strategy Monday that commits it to hunting down hackers already inside those networks and to ranking infrastructure by how much damage its failure would cause. For operators, the plan signals that federal attention and resources will flow to the systems judged most consequential, while broader, threat-agnostic support takes a back seat.
What Happened
CISA announced "CISA 2030: Defend, Harden, Prevail," which it said supports the White House's Cyber Strategy for America, issued in March, and the National Resilience Strategy.
The document is built on three pillars: Defend, which casts CISA as the lead for national cyber defense; Harden, which sets priorities for infrastructure security; and Prevail, which focuses on national resilience, meaning the ability to keep essential services running through a disruption.
In his welcome letter, Acting Director Nick Andersen wrote that a strong defense cannot guarantee there will be no intrusions and that resilience must be the foundation of the agency's approach. He wrote that CISA "will transition from passive defense to an aggressive, anticipatory stance" that removes adversaries' footholds in defense-critical infrastructure before they can be turned against U.S. systems.
The Harden pillar contains the sharpest change. CISA says it will deprioritize "threat-agnostic, all-hazards approaches" and instead use risk-informed, consequence-based analysis to concentrate effort on infrastructure whose disruption would most harm public health and safety, the economy and national security. It will support the White House in developing a National Risk Register to quantify risk to national infrastructure. Cybersecurity Dive reported that the register could be modeled on the United Kingdom's.
Other objectives include better asset visibility and anomaly detection in operational technology, the industrial control systems that run physical equipment; supply-chain integrity for those systems; and data-driven guidance on software security. CISA says it will build capacity through its 10 regional offices and expand priority emergency telecommunications using 5G, 6G and commercial satellites.
The plan sets a timeline: a programmatic review of core services and capabilities begins within 60 days, an approach to implementation and measuring outcomes follows within 180 days, and a progress update is due within 365 days.
Why It Matters
For boards of infrastructure operators, the strategy changes what to expect from Washington. Organizations that land high on a consequence-based ranking are likely to face closer engagement and pressure to show they can detect intruders quickly, evict them and keep operating. Those ranked lower should assume less direct federal help and plan their own defenses accordingly.
The focus on removing intruders already present treats compromise as expected. Executives should ask whether they could detect and contain an adversary already inside operational systems.
What the Plan Leaves Out
Cybersecurity Dive reported that the plan gives AI little attention and does not acknowledge workforce reductions that have shrunk the agency, including its field force of local advisers. It also does not explain how CISA will rebuild ties with operators after the administration ended a long-standing public-private partnership framework, the outlet reported, adding that CISA is now onboarding several hundred new hires to fill vacancies.
CyberScoop reported that critics say budget cuts have left the agency understaffed, including in areas the strategy emphasizes. The Primary Wire reported earlier this month, citing The Register, that Andersen has pitched voluntary programs as the agency's staff shrinks.
What to Watch
The 60-day review is the first test of which services survive. The 180-day plan should show how CISA defines its highest-consequence infrastructure and measures results, and the National Risk Register will help determine which operators fall inside the new focus.
