CISA Releases 10-Page 2030 Strategy Pledging 'Aggressive, Anticipatory' Defense of Critical Infrastructure

The Cybersecurity and Infrastructure Security Agency released a 10-page strategy on Monday, Oct. 26, that commits the agency to an "aggressive, anticipatory stance" against hackers sitting inside American critical infrastructure.

The document is titled CISA 2030: Defend, Harden, Prevail. It is built around three pillars, and it comes with deadlines.

What the strategy promises

"CISA will transition from passive defense to an aggressive, anticipatory stance that actively eliminates adversarial footholds in defense-critical infrastructure prior to weaponization against our systems," Acting Director Nick Andersen wrote in his introduction.

Andersen also conceded the limits of prevention. "There is no guarantee that a strong defense will eliminate intrusions," he wrote. "We must ensure that when adversaries gain a foothold, we are prepared to detect them quickly, evict them decisively, and keep critical operations running without interruption."

The three pillars:

• Defend: lead national cyber defense. Objectives include integrating federal, state, local and industry defenders, protecting operational technology, issuing software-security guidance and assessing emerging technology.
• Harden: prioritize national infrastructure security. That means coordinating intelligence, analyzing infrastructure data, working with international partners and focusing on the most important systems.
• Prevail: mobilize national resilience. CISA plans to invest in infrastructure resilience, strengthen communications interoperability and modernize planning and exercises.

The strategy also reaffirms CISA's role, delegated by the Department of Homeland Security, in leading the initiation and restoration of National Security and Emergency Preparedness communications during crises.

Cybersecurity Dive reports the document includes a foreword from Secretary of Homeland Security Markwayne Mullin praising President Trump's leadership. CISA says the strategy advances Trump's Cyber Strategy for America, published March 6, and his National Resilience Strategy.

The clock

CISA says it will begin a review of its core services and capabilities within 60 days. Within 180 days, it will complete an implementation plan that includes metrics for measuring success. Within 365 days, it will report on its progress.

The metrics are the part to watch. A strategy that promises to eliminate adversary access before weaponization needs a number attached to it, or nobody can tell whether it worked.

The staffing problem

Congressional lawmakers have said CISA lost nearly one-third of its workforce through layoffs and departures. The administration's fiscal 2027 budget request proposed eliminating roughly 870 positions. Tech Times puts the cut at nearly 968 positions and cites proposed budget reductions exceeding $707 million. The two position counts differ, and the final figures are not settled.

CISA has said it intends to hire more than 300 employees for mission-critical roles.

The administration frames the strategy as putting CISA "back on mission" after the agency took on a wider range of responsibilities. Cybersecurity Dive described the plan as an optimistic path for an agency the administration has repeatedly downsized. Tech Times argues the strategy's credibility depends on closing gaps the document does not fully address. It points to the workforce reductions, a mandatory incident-reporting rule under CIRCIA that it says has still not taken effect, and a trust deficit with private operators that it says a May 2026 CISA credential leak deepened. Those points come from that outlet's analysis, not from CISA.

The threat it targets

The stated target is persistent, pre-positioned access. Tech Times says the China-linked group Volt Typhoon has spent at least five years inside some U.S. critical infrastructure networks. That is the scenario "left of boom" defense is meant to address: finding and removing access in power, water and financial systems before it is used for physical disruption.

The strategy lands alongside other administration moves. The March national cyber strategy calls for using the full range of government capabilities, including offensive cyber operations, law enforcement and sanctions. In August, President Trump announced that federal law enforcement agencies are authorized to work with private firms on offensive cyber strikes against foreign threat actors targeting the U.S.

CISA's own role in those operations is not spelled out in the strategy. Its listed work is defensive: hunting, evicting and hardening.

Election infrastructure

Separately, CISA has been publishing election-security guidance ahead of the midterms. In its election document, the agency said Secretary Mullin tasked CISA in July with developing an Election Infrastructure Security Plan. "Election security is not a partisan issue," the document says. "Election security is national security." It lists no-cost services for state and local officials.

What comes next

Andersen has asked every owner, operator, vendor and manufacturer in the critical infrastructure community to "act now." What CISA itself can deliver depends on the 60-day service review and the 180-day implementation plan, which will show which services it keeps and what it measures. Staffing and funding levels for fiscal 2027 remain undecided.