The Cybersecurity and Infrastructure Security Agency has published a new plan for its next four years. The 10-page document is called CISA 2030: Defend, Harden, Prevail. According to CyberScoop, it came out on Monday, October 26. It sets out how the agency intends to handle national cyber defense, decide which critical infrastructure gets priority, and help the country keep running when something breaks.

The document is short, and it is not a technical advisory. It contains no CVEs, patches or indicators of compromise. Even so, it is worth reading if your work depends on CISA guidance, such as federal contractors, operational technology (OT) operators and state and local IT teams. It describes what the agency plans to spend its limited time and staff on. Below is a question-and-answer guide to what is known so far.

What is CISA 2030?

On its landing page for the strategy, CISA says the document "establishes the Cybersecurity and Infrastructure Security Agency's strategic vision for strengthening national cyber defense, prioritizing critical infrastructure security, and mobilizing resilience across the nation." The page says the strategy sharpens CISA's focus on its core missions of cybersecurity, infrastructure security and emergency communications. CISA also says it aligns with the core principles of the 2026 National Resilience Strategy and other Administration guidance.

CyberScoop reports two more alignments. The strategy is meant to fit the administration's broader cyber strategy, published in March, and last year's executive order on state and local preparedness. CyberScoop also says the strategy largely reaffirms the agency's existing roles.

One note on sourcing: our account of the document comes from CISA's landing page and from CyberScoop's coverage. We did not review the full strategy PDF. As of publication, CyberScoop is the only independent outlet we found reporting on the document itself.

What are the three pillars?

CISA names three pillars, each with its own goal:

  • Defend: lead national cyber defense.
  • Harden: prioritize national infrastructure security.
  • Prevail: mobilize national resilience.

CyberScoop lists the key objectives that sit under each pillar:

Defend. Integrate state, local and industry cyber defense, protect operational technology, develop guidance and best practices on software security, and assess and develop emerging technologies. OT means the industrial control systems that run physical processes such as pumps, valves and power distribution. It appears as its own objective, separate from ordinary IT security.

Harden. Coordinate intelligence for critical infrastructure, analyze infrastructure data, work with international partners, and emphasize strengthening the nation's most important infrastructure.

Prevail. Invest in critical infrastructure resilience, strengthen national communications interoperability, modernize planning and exercises, and build next-generation interoperable infrastructure. "Communications interoperability" means making sure different responders' radios and networks can talk to each other in a crisis. CISA's emergency communications mission covers that area.

Three pillars is not a new format. CyberScoop notes that CISA's 2023 strategic plan was also built on three pillars: address immediate threats, harden the terrain and drive security at scale.

What is the timeline?

CyberScoop reports three steps. CISA will begin reviewing its core services and capabilities within 60 days, to make sure they meet the strategy's key objectives. Implementation will then run over the next 180 days. A progress update is due after one year. Counting from the October 26 publication date, the review would start by late December and implementation would run into mid-2027, so changes to CISA services, if any, could begin appearing in the first half of 2027.

The strategy's title and CyberScoop's coverage describe it as looking ahead four years, to 2030. The service review is the part most likely to matter soon to organizations that use CISA's free offerings. The sources do not say which services are being reviewed or whether any will be cut, merged or expanded.

Why the focus on resilience?

The language around this strategy is about recovering from attacks, not only blocking them. In a foreword quoted by CyberScoop, Acting Director Nick Andersen wrote that "there is no guarantee that a strong defense will eliminate intrusions," and said that, as President Trump has reminded us, resilience must be the foundation of the approach. In his words, the goal is to "detect them quickly, evict them decisively, and keep critical operations running without interruption."

Andersen has been making this argument for months. In June, Cybersecurity Dive reported that he told a conference, "We are going to see an adversarial disruption of our critical infrastructure." Cybersecurity Dive's own framing is that CISA's emphasis on resilience marks a shift from earlier government doctrines focused on preventing intrusions.

That shift had already shown up in CISA's guidance. In May, The Record covered CI Fortify, a CISA initiative. It urges critical infrastructure organizations to proactively disconnect from third-party dependencies, to find ways to operate without reliable telecommunications and internet, and to restore compromised systems quickly while isolated. The Record reported that the initiative's webpage presents it as a way to combat nation-state campaigns including Volt Typhoon, in which Chinese actors prepositioned on US critical infrastructure. Andersen told The Record the effort was "not in response to any particular nation-state actor." "Prepositioning" means an intruder quietly gaining access ahead of time so it can cause disruption later.

The Record and Cybersecurity Dive stories both came out before CISA 2030. Neither is coverage of the strategy. We cite them as context because they show the same resilience thinking that the "Prevail" pillar reflects: CISA's leadership is planning for disruptions that defenders could not stop.

Can CISA actually deliver it?

That is the main question critics raise. CyberScoop reports that critics say much of CISA has been badly diminished by budget cuts, including in areas the new strategy specifically focuses on, leaving the agency understaffed. A strategy with objectives on OT, software security, intelligence coordination, international partnerships and communications modernization needs people to carry it out. The sources give no staffing numbers and no budget figures tied to the plan.

The service review may be the clearest sign of how CISA plans to reconcile its goals with its resources. Whatever the review concludes about which core services continue, and in what form, will probably say more than the strategy document does.

What It Means for Defenders

This is a policy document, not a vulnerability disclosure. There is nothing to patch, nothing to rotate and no fixed version to install. What it gives you is planning information. Here is how to use it, depending on who you are.

Critical infrastructure and OT operators. The strategy names OT protection under Defend and resilience investment under Prevail. Read it together with the CI Fortify guidance The Record covered in May, which is the most concrete version of the resilience message in these sources. Check whether essential operations can keep running if you are cut off from third-party providers and reliable internet or telecom service. Also check whether you can restore compromised systems while those systems stay isolated. If either answer is no, you have a gap that is at odds with the direction CISA is setting.

State and local government IT. The first Defend objective is to integrate state, local and industry cyber defense, and CyberScoop says the strategy is meant to align with last year's executive order on state and local preparedness. Expect CISA's work with your jurisdiction to be shaped by this plan. Keep an eye on the results of the service review.

Organizations that rely on free CISA services. CyberScoop reports a review of core services beginning within 60 days and implementation over the following 180 days. If your security program depends on a CISA service, write down which ones, and plan for the possibility that delivery changes. The sources do not say which services are affected.

Software vendors. Guidance and best practices on software security are listed under Defend. Expect continued guidance from CISA on how software should be built and shipped.

Federal contractors, including those working through CMMC. The strategy does not change contractual requirements. It does show where CISA's priorities are heading: toward assuming an intrusion may happen and proving you can keep operating. Contingency plans and recovery exercises are a good place to put effort, especially since modernizing "planning and exercises" is one of the Prevail objectives.

Everyone. The progress update due after one year is the first chance to see what has actually been delivered. Until then, treat the strategy as a statement of priorities, and keep in mind the staffing concerns critics have raised.

Sources