The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has published a new four-year strategy, "CISA 2030: Defend, Harden, Prevail", setting out a shift from largely reactive cyber defence towards anticipating and stopping attacks on critical infrastructure earlier.

Released on 26 October, the plan is built around three pillars: leading national cyber defence, prioritising the infrastructure whose disruption would cause the most harm, and mobilising national resilience, including emergency communications. It covers federal, state, local, tribal and territorial partners, private infrastructure owners and international allies.

From reaction to removal

The central change is one of timing. Rather than mainly responding after an intrusion is found, CISA says it aims to detect hostile access inside defence-critical networks and remove it before it can be turned into disruption. The strategy gives particular attention to operational technology — the systems that run industrial and utility operations — alongside software security and emerging technologies, where a compromise can affect physical services as well as data.

Deadlines will test the plan

CISA has tied itself to a public timetable: a review of its core services within 60 days, an implementation and measurement plan within 180 days, and a progress report after one year. Some coverage has questioned whether staffing and funding will match the ambition, so those early milestones — and any follow-up hiring or funding decisions — will be the first real test of whether the strategy changes practice or remains a statement of intent. For infrastructure operators, the immediate message is to map their own security priorities against the three pillars.

Sources: Particle News and CyberMaterial.