CISA 2030 Strategy: What Critical Infrastructure Operators Need to Know

In October 2026, CISA published CISA 2030: Defend, Harden, Prevail, its strategy for defending and hardening US critical infrastructure. Critical infrastructure owners and operators are among the partners it calls on and it is frank about the risk. CISA's Acting Director Nick Andersen writes, "[There is] no guarantee that a strong defense will eliminate intrusions." The strategy treats intrusion as something to plan for. That puts continuity of communications at the center of an organization's resilience plan.

Scope and Status for Owners and Operators

The strategy is CISA's own roadmap and it is advisory for owners and operators. It sets commitments for CISA and calls on federal, state, local, tribal, and territorial governments, along with owners and operators, to act. It states no binding requirements for them. It says it advances the President's Cyber Strategy for America (March 2026) and Executive Order 14239.

CISA sets three milestones for itself. Within 60 days, it will begin a programmatic review of its core services and capabilities. Within 180 days, it will deliver an approach for implementing the strategy and measuring outcomes. Within 365 days, it will deliver a progress update.

The Three Pillars of CISA 2030

1. Defend: Lead National Cyber Defense

CISA will integrate the cyber defense capabilities of government, industry, state, local, tribal, and territorial partners as well as those of international organizations. It says it will move from passive defense to an anticipatory stance, eliminating adversarial footholds in defense-critical infrastructure before they can be weaponized. The pillar also covers modernizing operational technology (OT), software security and supply chain transparency, and securing emerging technology.

2. Harden: Prioritize National Infrastructure Security

CISA will deprioritize threat-agnostic, all-hazards approaches in favor of risk-informed, consequence-based analysis. It will focus on infrastructure whose disruption would most affect public health and safety, continuity of the economy, and national security, and it will support the White House in developing a National Risk Register. CISA also plans to mature its intelligence-to-operations pipeline for real-time alerts and to build frameworks that let Sector Risk Management Agencies (SRMAs), states, communities, and operators act locally.

3. Prevail: Mobilize National Resilience

CISA will build capacity through its ten regional offices and modernize planning and exercises. It reaffirms its delegated role in leading the initiation and restoration of national security and emergency preparedness (NS/EP) communications. It plans to expand priority voice, video, data, and information services using 5G/6G and commercial satellite constellations, and to invest in scalable, encrypted, resilient infrastructure that protects emergency communications.

What Operations and Security Teams Should Expect

Expect closer federal engagement on detection and eviction, though the text does not yet describe how it will work. On OT, CISA commits to working with owners and operators to modernize control environments, improve asset visibility and anomaly detection, and assure supply chain integrity. An organization that cannot list its OT assets or spot unusual behavior on them may struggle to take part.

The strategy is also frank about CISA itself. Eight years after its founding, it says, shifting scope and unclear prioritization have cost the agency focus and agility; it commits to changing its operating model. Day-to-day engagement between owners and operators and the agency may change with it.

Where Procurement and Compliance Teams Should Look

Start with the consequence test. If CISA concentrates its attention on infrastructure whose disruption would do the most harm, you need to know where your assets sit on that scale. CISA also commits to data-driven guidance on software security and supply chain transparency, so expect more questions about the software and suppliers you rely on. The strategy sets no binding requirements, so watch your SRMA for guidance that turns these commitments into expectations.

Why Continuity of Communications Belongs at the Center of a Resilience Plan

All three pillars emphasize reliable communications. CISA's commitments concern its own services, not purchasing requirements for organizations, but the same principle applies to infrastructure owners and operators. If an intruder is inside the enterprise network, leaders and operators cannot rely on that network as the only place to coordinate.

When you evaluate communications vendors, consider five things.

1. You should control the infrastructure and encryption keys

2. Independent bodies should certify the product, and the certificate, its scope, and the product version should be open to review

3. Every participant should be identity-verified

4. The service should run out-of-band, meaning on a path that does not depend on your primary network

5. It should also keep accountability records so decisions can be reconstructed afterward

Make a sovereign, certified channel the default for sensitive coordination. BlackBerry® Secure Communications provides secure, sovereign-controlled communication systems for operational continuity and crisis response, is certified to NIAP and NATO Restricted standards, and combines identity validation, device hardening, metadata protection, and system-level governance. It does not detect or remove intruders, and it does not replace the priority services CISA operates.

Recommendations for Continuity and Resilience Planning

Start by ranking your assets by consequence. List the systems whose disruption would do the most damage to public health and safety, the economy, or national security. CISA says it will set priorities on that basis, so your list should match. Then contact your SRMA and regional office. The strategy relies on both for local action, so ask what support they expect to offer.

Next, close visibility gaps in OT. Build an asset inventory and anomaly detection for control systems. The strategy names both, and both shorten the time between intrusion and detection. Then run exercises built around an adversary foothold. Rehearse detecting, evicting, and operating through an intrusion, including the loss of enterprise communications.

Set up a sovereign, certified continuity channel. Evaluate the available options and require every vendor to show its certificate, scope, and version. Define who uses the channel and when, then test that it works with the enterprise network unavailable. Finally, track CISA's milestones: the programmatic review, the implementation approach, and the progress update. Confirm dates once CISA publishes the start of each period.

The strategy does not promise that defenses will hold, and it says so plainly. The operators who handle the next intrusion best will be the ones whose people can still communicate and keep the service running while the intrusion is contained.