The Cybersecurity and Infrastructure Security Agency has published a four-year strategy that refocuses its mission around three priorities: defending national networks, hardening critical infrastructure and prevailing through resilience. The 10-page CISA 2030: Defend, Harden, Prevail calls for a review of the agency’s core services within 60 days, implementation during the following 180 days and a public progress update after one year.
Acting CISA Director Nick Andersen said in the strategy’s foreword that the agency must operate with “renewed purpose” as nation-state groups and other adversaries improve their ability to compromise networks. The plan acknowledges that prevention alone will not stop every intrusion, and emphasizes rapid detection, removal of attackers and continuity of critical operations.
Under defend, CISA plans to integrate federal, state, local and private-sector cyber defense; protect operational technology; develop software-security guidance and best practices; and assess emerging technologies. The harden pillar prioritizes intelligence coordination, infrastructure-data analysis, international cooperation and protection of the country’s most important systems.
The final pillar, prevail, focuses on investing in critical-infrastructure resilience, improving communications interoperability, modernizing exercises and planning, and building interoperable infrastructure for future needs. Those objectives align with the White House’s Cyber Strategy for America, released March 6, which also identifies energy, finance, telecommunications, data centers, water and health care as infrastructure priorities. The approach extends CISA’s established emphasis on measurable risk reduction, secure technology and resilience outlined in its FY2024-2026 cybersecurity plan.
The strategy arrives as CISA faces questions about whether its resources match its expanding responsibilities. Congressional lawmakers have said the agency lost nearly one-third of its workforce through layoffs and departures, while the administration’s fiscal 2027 budget request proposed eliminating roughly 870 positions; CISA has also said it intends to hire more than 300 employees for mission-critical roles. The final staffing and funding levels remain unsettled, making the coming service review and implementation plan an important test of whether the new priorities can be executed across government and industry.
