CISA has released a new long-range plan for protecting the systems that keep power, water and phone service running. CISA says its strategy, titled "CISA 2030: Defend, Harden, Prevail" and dated October 2026, is its roadmap for cyber, physical and geopolitical threats to critical infrastructure.
The plan is not only aimed at big utilities. Acting Director Nick Andersen called on the whole critical infrastructure community, from owners and operators to vendors and technology makers, to act now. For the small firms that sell into that world, the strategy is a signal of where buyers and regulators are heading.
Key facts
- The strategy has three pillars: Defend, which means leading national cyber defense; Harden, which means putting national infrastructure security first; and Prevail, which means rallying national resilience.
- CISA set 60-, 180- and 365-day milestones to review its core services, deliver a plan with measures and report on progress.
- CISA says it will shift from a passive defense to a more aggressive, forward-looking stance aimed at finding and cutting off malicious access.
- The document says CISA will focus on infrastructure whose disruption would hurt public health and safety, the economy and national security the most.
- The strategy itself does not create new mandatory rules, deadlines or penalties for vendors or owners.
Background
CISA was set up inside the Department of Homeland Security in 2018, according to the strategy's foreword. The agency now admits that eight years in, a mission that kept changing and fuzzy priorities have cost it focus and speed.
The new plan steps back from threat-agnostic, all-hazards work to concentrate on the highest-impact targets. CISA says it lines up with the 2026 National Resilience Strategy and narrows its attention to cybersecurity, infrastructure security and emergency communications. Andersen writes that it carries out President Trump's Cyber Strategy for America, issued in March 2026, and Executive Order 14239.
In his words, "CISA 2030 provides a focused roadmap to strengthen defenses, eliminate adversarial footholds" across the sectors it protects.
What it means for you
The strategy names essential services such as energy, water, transportation and telecommunications. It says CISA will build frameworks for Sector Risk Management Agencies, owners and operators, and state, local, tribal and territorial partners. Which sectors or sites will rank highest is not spelled out.
Suppliers should watch three areas.
Operational technology. CISA says it will help owners and operators update OT systems, see their assets more clearly, spot unusual activity and protect the OT supply chain. Firms that install or service control systems are part of that chain.
Software. The plan says CISA will work with partners on data-based guidance to push software security and supply chain transparency. CISA's 2026 Minimum Elements for a Software Bill of Materials cover all software, including open-source, AI and SaaS products, and the draft drew more than 90 comments. More than 200 software makers have signed CISA's Secure by Design Pledge, promising a good-faith effort toward seven goals.
Incident reporting. Once the CIRCIA final rule takes effect, CISA says covered groups must tell the agency about ransom payments within 24 hours and about certain cyber incidents within 72 hours. The cited pages do not say when that rule will be issued.
CISA's Secure by Design page notes that consumers and small organizations have carried too much of the security load compared with technology producers. Our cybersecurity services help small teams take on the basics without a large staff.
Practical steps
Most of the tools CISA points to are free. Cyber Hygiene services are open to U.S.-based federal, state, local, tribal and territorial governments and to public and private critical infrastructure groups.
- Start with the three basics. CISA suggests beginning with three services: reach out to a regional Cybersecurity Advisor, sign up for Cyber Hygiene, and complete a Cybersecurity Performance Goal (CPG) assessment. Small and midsize groups can use the CPG review to rank the most important actions.
- Scan what faces the internet. Cyber Hygiene scanning watches internet-facing assets and sends weekly reports, plus alerts on urgent findings such as known exploited flaws, at no cost.
- Isolate OT in stages. CISA's CI Fortify guidance, written with Australian, UK and Canadian partners, tells OT operators to find and map vital systems, build separation points, and plan and test step-by-step isolation.
- Consider decoys. A CISA guide on cyber decoys urges critical infrastructure groups to add decoy tools alongside Zero Trust models.
- Ask better questions when buying. CISA's Secure by Demand guide is built for any software customer to use when talking with resellers or service providers.
A tested recovery plan matters as much as prevention. Our disaster recovery planning can help with isolation and restore drills, and managed IT services can handle day-to-day patching and monitoring. For a ransomware-focused starting point, see the ransomware checklist for small firms.
What happens next
Within 180 days, CISA says it will deliver a plan to carry out the strategy and track results against its pillars and goals. Specific requirements, if any, are expected there. Budget and staffing for the plan have not been stated.
CISA says it will also expand priority telecom services with newer tools such as 5G/6G and commercial satellite networks. It will add capacity through its ten regional offices so it can respond to threats faster. The strategy says CISA will help the White House build the National Risk Register and other ways of putting numbers on infrastructure risk. It will also lead national work on securing new technologies such as super intelligence and quantum computing.
On incident reporting, CISA said its CIRCIA town halls would start June 15 and that stakeholders could weigh in before the rule is final.