CISA Sets Out a Four-Year Plan to Defend, Harden and Recover from Cyber Attacks

The US Cybersecurity and Infrastructure Security Agency (CISA) has published a 10-page strategy called "CISA 2030: Defend, Harden, Prevail". It focuses on taking a leading role in cyber defence, protecting critical infrastructure and building the ability to withstand attacks. The strategy largely reaffirms the agency's existing roles. CISA will begin reviewing its core services and capabilities within 60 days, implement changes over the following 180 days, and report on progress after one year.

Acting CISA Director Nick Andersen said the threat landscape is not static. He noted that nation-state actors and other malicious adversaries are growing more sophisticated, and that a strong defence will not guarantee intrusions are prevented. His message was that resilience must be the foundation: organisations should be ready to detect intruders quickly, remove them decisively and keep critical operations running without interruption.

Under the "defend" pillar, the stated objectives include integrating state, local and industry cyber defence, protecting operational technology, developing guidance and best practices on software security, and assessing emerging technologies. Andersen also called on every organisation in the critical infrastructure community, from owners and operators to vendors and technology manufacturers, to act now. The strategy is designed to align with the US administration's broader cyber strategy published in March.