The United States Cybersecurity and Infrastructure Security Agency (CISA) unveiled its new strategy aimed at strengthening the country’s cyber defense to bolster critical infrastructure security. The CISA 2030: Defense, Harden, Prevail report outlined the agency’s roadmap, calling for advancing the Trump Administration’s Cyber Strategy for America and National Resilience Strategy. It further aims to address the increasingly complex threat environment, strengthen national cyber defense, and prioritize the infrastructure most essential to America’s national security, economy, public health, and safety.
To counter emerging threats, the agency will shift from passive cybersecurity defense to proactively identifying and removing attackers from critical infrastructure networks before they can disrupt operations. That strategy will further prioritize operational technology (OT) security, software vulnerabilities, emerging technologies, and protection of essential services.
CISA will also strengthen coordination with infrastructure operators, improve threat intelligence, and focus resources on systems whose disruption would have the greatest consequences for national security, public health, and the economy.
“I call on every company and organization in the critical infrastructure community – from owners and operators to vendors and technology manufacturers – to act now,” explained CISA Acting Director Nick Andersen. “CISA 2030 provides a focused roadmap to strengthen defenses, eliminate adversarial footholds, and deny them any advantage that could endanger the nation’s security, economy, or public health.”
According to the agency, CISA 2030 will be guided by the three pillars: to “Defend,” the efforts to lead national cyber defense; “Harden,” prioritizing national infrastructure security; and “Prevail,” to mobilize national resilience, under which CISA will strengthen security across the interconnected physical and cyber dimensions of critical infrastructure.
“The strategy recognizes that cyber, physical, and geopolitical threats increasingly intersect and can disrupt essential services Americans rely on every day. CISA will work with public- and private-sector partners to strengthen the security and resilience of operational technology, advance software security, support secure emerging technologies, and improve continuity of National Security and Emergency Preparedness communications,” the agency emphasized.
CISA will begin reviewing its core services and capabilities within 60 days and report progress within one year.
The Devil is in the Details
The strategy is meant to shift the CISA from a passive defense posture to an aggressive, anticipatory stance. However, John Strand, owner of Black Hills Information Security, told ClearanceJobs that “as always, the devil is in the details.”
This new shift is also coupled with the immense budget cuts CISA has had to deal with, which could make achieving this mission exceedingly difficult.
“We’re talking about thousands of municipalities and critical infrastructure organizations that need protection under this umbrella. Every single one needs money. Every single one needs resources. And every single one needs help upgrading aging infrastructure,” warned Strand. “That takes more than a press release.”
Still, the new strategy should reinforce an important reality: protecting critical infrastructure requires securing not just the software organizations deploy, but the changes that software makes to critical systems.
“Databases underpin essential services across financial institutions, healthcare, energy, and government,” added Ryan McCurdy, vice president of marketing at cybersecurity provider Liquibase. “Yet database changes often lack the same automated security checks, policy enforcement, and visibility applied to application code.
Emerging threats will also need to be addressed.
“As AI accelerates software development, that gap becomes increasingly consequential,” McCurdy told ClearancesJobs. “Organizations need to validate database changes before deployment, enforce consistent policies, detect configuration drift, and maintain a clear record of what changed, when, and by whom.”
The Three Pillars
The CISA 2030 strategy will require cooperation between industry and the government to reduce cyber risks, along with focusing resources on critical infrastructure sectors, improving the National Security and Emergency Preparedness (NS/EP) communications, and then building resilient partnerships for rapid collective response/
“CISA is right to prioritize software security and operational resilience,” suggested McCurdy. “Extending those principles to the database layer is an important step toward protecting the integrity and availability of the systems Americans depend on.”
This may also be seen as an important first step from CISA, but it may still come down to whether the agency receives the necessary support – including funding – to accomplish this mission.
“I like the direction and the renewed focus on critical infrastructure,” said Strand. “But I think everyone should pause, take a deep breath, and wait to see when the money actually starts flowing and how it gets allocated.”
