CISA 2030 strategy sets out a shift towards proactive US cyber defence

The US Cybersecurity and Infrastructure Security Agency (CISA) published its new strategy, CISA 2030: Defend, Harden, Prevail, on 26 October 2026. The strategy establishes priorities for national cyber defence and critical infrastructure protection in response to persistent threats from state-sponsored actors and other malicious groups.

The document advances President Donald Trump’s Cyber Strategy for America and National Resilience Strategy. It places cybersecurity within a broader framework of physical security, geopolitical competition and national resilience, with a focus on protecting infrastructure that supports essential services.

The strategy is organised around three pillars. Defend positions CISA as a leader in national cyber defence, with an emphasis on cooperation across federal, state and local authorities and the private sector. It also covers operational technology security, software security and the assessment of emerging technologies.

Harden focuses on prioritising infrastructure according to the potential consequences of disruption. Rather than applying the same approach to every system, CISA intends to concentrate on those whose compromise could have the greatest effects on public safety, economic security and national security.

Prevail addresses national resilience, including continuity planning, emergency communications and coordinated responses to disruption. It aims to strengthen the ability of essential services to continue operating during and after cyber incidents.

Across these pillars, CISA plans to improve threat intelligence sharing, assess infrastructure risks and strengthen the security of interconnected digital and physical systems. The strategy combines efforts to prevent intrusions with measures to limit their consequences when prevention fails.

A central element is a shift towards proactive threat disruption. Instead of focusing primarily on responding after a breach, CISA intends to identify malicious access and disrupt adversary activity before attackers can exploit their foothold. This approach is particularly relevant to operational technology (OT), which controls physical processes in sectors such as energy, water, manufacturing and transportation. Compromises in these environments can affect public safety and the continuity of essential services.

Software security, emerging technologies and supply-chain dependencies are also identified as areas requiring attention.

CISA has outlined three implementation milestones. Within 60 days, the agency plans to begin reviewing its core services and capabilities against the strategy’s objectives. Within 180 days, it is expected to produce an implementation plan and define how progress will be measured. A further update is scheduled within 365 days.

Why does it matter?

The strategy reflects an approach to cybersecurit