The US Cybersecurity and Infrastructure Agency (CISA) has promised to move away from “passive defense” and towards an “aggressive, anticipatory” approach to cyber-threats affecting critical infrastructure.
This was the message of CISA’s new strategy document, CISA 2030: Defend, Harden, Prevail, published on October 26.
The agency provided details on how it will adopt a proactive stance when defending critical infrastructure, including responding to threats faster and building resilient systems.
Nick Anderson, acting director of CISA, wrote in the new CISA document: “The threat landscape we face today is not static. Nation-state actors and other malicious adversaries continue to grow more sophisticated in their efforts to compromise our networks, and there is no guarantee that a strong defense will eliminate intrusions.”
He added: “As President Trump has reminded us, resilience must be the foundation of our approach. We must ensure that when adversaries gain a foothold, we are prepared to detect them quickly, evict them decisively, and keep critical operations running without interruption.”
The strategy is designed to execute recent White House policy announcements around cybersecurity.
This includes the national cyber strategy published in March 2026, which outlined a broad framework for addressing cyber threats through government coordination, private sector partnerships and technological investment.
It emphasized using the full range of government capabilities, including offensive cyber operations, law enforcement measures and economic sanctions, to deter attacks and dismantle criminal networks.
In August 2026, President Trump announced that federal law enforcement agencies have been authorized to collaborate with private firms in conducting offensive cyber strikes on foreign threat actors targeting the US.
Read now: FBI Publishes First-Ever Cyber Strategy, With Focus on Disrupting Threat Actors
The CISA 2030 Three Pillar Strategy
The new CISA strategy sets out a roadmap to reach objectives across three pillars by 2030. These are:
Defend: Lead National Cyber Defense
CISA said it will integrate cyber defense capabilities of government, industry, State, Local, Tribal, and Territorial (SLTT) partners, and international organizations to improve the understanding of threat activity, reduce national cyber risk and strengthen cyber defenses.
One focus area will be to work with operational technology (OT) owners and operators to modernize OT environments and enhance supply chain security.
Another will be to lead the assessment and rapid deployment of emerging technology for cybersecurity.
Harden: Prioritize National Infrastructure Security
This CISA 2030 pillar will focus on integrating intelligence across critical infrastructure security operations.
This includes targeted investment in modernized tools to enable real-time decision making and alerts, as well as accelerating operational response across the critical infrastructure community.
Intelligence will also be used to ensure CISA can prioritize its efforts and resources in the areas that have the biggest impact on national infrastructure security.
Prevail: Mobilize National Resilience
The strategy also emphasized the need to ensure resilient communications and connectivity in the face of growing cyber-attacks.
CISA said it will expand priority telecommunications services utilizing next-generation capabilities to ensure emergency connectivity.
The agency will also invest in scalable, encrypted, and resilient infrastructure that enables integrated operation, protects emergency communications, and ensures continuity of essential functions in the event of disruption.
Read now: US Sanctions Chinese Hackers for Treasury, Telecom Breaches
CISA promised to deliver an approach for implementation and measurement of outcomes within 180 days, and an update on its progress against implementation within 365 days.