THE CRUNCH
CISA has published a new strategy, CISA 2030: Defend, Harden, Prevail, which the agency says will strengthen the security and resilience of America's critical infrastructure. The plan advances the White House's Cyber Strategy for America and National Resilience Strategy, and responds to what CISA describes as a threat landscape evolving at an unprecedented pace, with nation-state actors growing more sophisticated in attempts to compromise US networks.
The headline shift is from a passive defence posture to what the agency calls an aggressive, anticipatory stance: identifying, mitigating and reducing malicious access to critical infrastructure rather than waiting for incidents. CISA also says it will improve how it prioritises risk, mobilises partners and supports rapid coordinated action when threats emerge.
Work with public- and private-sector partners will focus on several fronts: strengthening the security and resilience of operational technology (the systems that monitor and control critical infrastructure), advancing software security, supporting secure emerging technologies, and improving continuity of National Security and Emergency Preparedness communications, which keep government and public safety services running during crises.
Operational technology security has been a live topic: earlier this month, the Operational Technology Cybersecurity Coalition published a white paper urging CISA to create a directive centred on operational technology. Acting Director Nick Andersen called on "every company and organization in the critical infrastructure community, from owners and operators to vendors and technology manufacturers, to act now", describing CISA 2030 as a roadmap to strengthen defences and eliminate adversarial footholds.