This audio is auto-generated. Please let us know if you have feedback.
The Cybersecurity and Infrastructure Security Agency on Monday laid out an ambitious vision for protecting U.S. government networks and critical infrastructure systems over the next four years.
The “CISA 2030: Defend, Harden, Prevail” strategy charts an optimistic path forward for an agency that the Trump administration has repeatedly downsized and marginalized for political reasons. The document — which includes a forward from Secretary of Homeland Security Markwayne Mullin praising President Trump’s leadership — aligns with the White House’s public messaging about how it is putting CISA “back on mission” after the agency took on a wider range of responsibilities.
Administration officials used the strategy to promise a more proactive CISA that stays ahead of evolving cybersecurity threats.
“CISA will transition from passive defense to an aggressive, anticipatory stance that actively eliminates adversarial footholds in defense-critical infrastructure prior to weaponization against our systems,” Nick Andersen, the agency’s acting director, said in an introductory statement.
“Resilience must be the foundation of our approach” because of how quickly the threat environment is changing, Andersen added. “We must ensure that when adversaries gain a foothold, we are prepared to detect them quickly, evict them decisively, and keep critical operations running without interruption.”
The plan outlines CISA’s commitments in three areas: basic defense, long-term hardening and systemic resilience to disruptions.
Within 60 days, CISA said, it will begin a review of its “core services and capabilities.” Within 180 days, the agency will complete a plan for implementing the strategy that includes metrics for measuring success. CISA will provide an update on implementation after one year.
Defending with partners
The first part of the plan addresses the core of CISA’s responsibilities: working with other federal agencies, state and local governments, critical infrastructure organizations, private companies and international allies to prevent hackers from sowing chaos across vital U.S. systems.
“Our adversaries will continue to develop and deploy advanced capabilities,” CISA said in the document, “and we must work with partners to detect, disrupt, and mitigate cyber threats while helping rapidly remove adversaries from compromised systems.”
CISA said it would “integrate” various partners’ capabilities to develop a better picture of the threat landscape and generate better defensive measures. It also said it would help infrastructure operators implement better security measures for their operational technology, including stronger asset visibility and intrusion detection.
Supply-chain security receives special attention in the plan, with CISA promising to “develop data-driven guidance and best practices” to help organizations understand and secure their third-party dependencies.
Emerging technologies such as AI receive scant attention in the document, although CISA promises to oversee efforts to both deploy and secure those technologies.
Fortifying against growing threats
Prioritization is another core tenet of the new CISA strategy. The agency vowed to “build capacity” throughout critical infrastructure sectors by creating processes to help its partners “focus resources where they will have the greatest impact.”
The U.S. cannot defend every computer system, cybersecurity experts say, so it must focus on the most important assets. For CISA, part of protecting those assets is understanding how they connect to each other and how they could fail.
The strategy commits CISA to improving intelligence-sharing ties with spy agencies and private firms, assessing infrastructure to support prioritization decisions (including through a U.K.-style National Risk Register) and leading the deployment of “meaningful and measurable security improvements” to infrastructure operators.
CISA’s risk-forecasting and asset-prioritization efforts have undergone several changes over the past decade. During the first Trump administration, the agency launched a program to identify the “National Critical Functions” essential to daily life and organized society. Under the Biden administration, that effort morphed into a focus on “systemically important entities.”
Preparing for the inevitable
CISA has spent 2026 warning companies that disruptions are inevitable and their top priority should be preparing to operate in a degraded state, rather than trying to prevent intrusions altogether. In May, the agency and international partners released fortification guidance intended to help companies improve resilience. And in June, Andersen hammered home the point by acknowledging the inevitability of a major nation-state hack of U.S. critical infrastructure.
The new strategy continues that emphasis on persistent service delivery in the aftermath of an attack.
“National critical infrastructure resilience can no longer be defined simply by how we respond to disruption, but by the model we build to withstand it,” the document says.
To that end, CISA said it would continue its work to “ensure continuity of communications” during an emergency, along “investing in scalable, encrypted, and resilient infrastructure” that keeps vital services running after disruptions. The agency promised to use “advanced analytics, emerging technologies, intelligence, and cross-sector collaboration” to maintain a real-time understanding of infrastructure operators’ susceptibility to major compromises.
All of those readiness activities will require strong connections between CISA and a nationally dispersed network of infrastructure organizations. CISA’s field force of local advisers has dwindled as the Trump administration has downsized the agency, but CISA did not acknowledge those challenges in the new strategy, instead vowing to “build capacity through our ten regional offices to enable rapid mobilization against a persistent threat landscape.”
“CISA will equip its advisors to be the cyber and physical security workforce of today and tomorrow,” the agency said.
CISA’s dubious future
It remains unclear how CISA will be able to strengthen its partnerships with infrastructure operators that it has alienated with a flurry of changes and degradations to longstanding partnerships. The Trump administration eliminated a decades-old partnership framework, effectively freezing many important collaborative efforts between industry and government, and it has been slow to replace that system. The administration also stopped funding the information sharing group for state and local governments, forcing many of them to leave the group and forgo essential services.
Other cuts have focused on CISA itself. The Trump administration tried to eliminate the division that coordinates partnerships and scrapped a series of free assessments for infrastructure operators. In February, Andersen told staffers that CISA planned to “turn off” certain programs as it refocused its priorities.
The hollowing out of CISA has been most evident in election security, where some state and local officials say the agency has become virtually useless. but other infrastructure sectors have also complained about a lack of federal support in their fight against hackers.
Andersen, CISA’s acting director, has expressed a desire to turn around the agency’s fortunes. CISA is in the process of onboarding several hundred new employees to fill critical vacancies left by the Trump administration’s earlier workforce purges.