- What: CISA 2030: Defend, Harden, Prevail, published October 2026, is the agency's new strategy. Three pillars, twelve key objectives, and a stated 60, 180 and 365 day implementation clock.
- Impact: CISA commits to deprioritize threat-agnostic, all-hazards approaches in favor of risk-informed, consequence-based analysis. Any security pitch whose headline is breadth of coverage now runs against the strategy rather than with it.
- What to do: stop measuring your program by how much you can see and start ranking by what failure costs. The strategy also assumes prevention fails, so detection, eviction and continuity carry the weight, in that order.
- Who is affected: critical infrastructure owners and operators, their Sector Risk Management Agencies, and every vendor selling into them. There is no certification attached, which is exactly why the claims will get loose.
Strategy documents are usually safe to skim. This one is not, because it does something strategy documents almost never do: it names what the agency will stop spending effort on.
CISA 2030: Defend, Harden, Prevail arrived this month, with a foreword from DHS Secretary Markwayne Mullin and a welcome from CISA Acting Director Nick Andersen. It is the roadmap for executing the Cyber Strategy for America, Executive Order 14239, and the National Resilience Strategy. The structure is three pillars carrying twelve key objectives.
It is also unusually direct about why it needed writing. The agency diagnoses its own drift in plain language, stating that eight years after its founding, a widening mission and unclear prioritization "have come at the expense of the focus and agility required to respond to a dynamic and evolving threat landscape." Agencies rarely open by conceding they lost the thread. The corrections that follow are specific enough to plan against.
Two shifts that matter more than the pillar names
The first shift is the one that will reshape procurement language. The strategy moves away from threat-agnostic breadth and toward "risk-informed, consequence-based analysis," concentrating effort on the infrastructure whose disruption would do the most damage to public health and safety, continuity of the economy, and national security.
Read it as a buyer. For years the winning pitch into critical infrastructure has been coverage: every log source, every protocol, total visibility. That pitch is now misaligned with the strategy the buyer is being measured against. The question stops being how much you can see and becomes which assets matter and what their failure costs. Breadth becomes table stakes, and the differentiator moves to consequence ranking. We are including our own marketing in that criticism, because some of it has been written the old way.
The second shift is that the document assumes prevention fails. Andersen states there is "no guarantee that a strong defense will eliminate intrusions," and makes resilience the foundation instead: detect quickly, evict decisively, and keep critical operations running throughout. CISA also commits to an anticipatory posture that eliminates adversarial footholds in defense-critical infrastructure prior to weaponization. That is a dwell-time problem rather than an alerting problem, and it is a harder one: finding an adversary who is already established and has not yet acted.
A third change is quieter but widens scope. The strategy treats physical and cyber as a single domain on the grounds that the two "can no longer be treated as separate." For anyone working industrial environments that has always been true in practice. It is now true on paper, which matters when budget lines get drawn.
The three pillars and their twelve objectives
Quoted as CISA words them, because the exact phrasing is what buyers will cite back to you.
- Forge Collective Cyber Defense
- Strengthen the Security and Resilience of Operational Technology (OT)
- Position Software Security as a Strategic Advantage
- Secure America's Technology Ecosystem
- Integrate Intelligence Across Critical Infrastructure Security Operations
- Enable Risk-Informed Prioritization
- Partner for Operational Impact
- Fortify the Nation's Most Important Infrastructure
- Advance Secure and Resilient Regional Capabilities
- Strengthen Nationwide Interoperability and Continuity of NS/EP Communications
- Modernize Planning and Exercise Capabilities
- Build Next-Generation, Interoperable Infrastructure
The OT objective is the most product-shaped sentence in the document: "modernize OT environments, improve asset visibility and anomaly detection, and assure OT supply chain integrity." Three named capabilities, and they are three separate claims rather than one.
Where we already stand
Four of the twelve objectives describe, almost in product terms, work that is already shipping in our stack. Set against the rest, that is a narrow and specific fit, and it is worth stating as such.
Industrial protocol decoding and ICS detection content. We decode the protocols that carry industrial process traffic and ship detection content mapped to ATT&CK for ICS, including the recent technique additions covering command and scripting interpreters on control systems. Events normalize into an open schema rather than a proprietary one, which is the precondition for correlating across sectors at all.
Threat intelligence in both directions. We ingest structured intelligence from multiple sources, and we publish it onward through a standards-based feed server. An intelligence-to-operations pipeline among partners needs both legs. Most vendors only consume.
Intelligence that becomes detection without a human in the middle. Newly published vulnerabilities feed a pipeline that generates detection content grounded in our own schema and tests it against the query engine before an analyst sees it. Content is staged for review rather than pushed straight to production, which is the correct default when the author is a model.
Dependency-change review before installation. Against the software security objective, we publish tooling that shows what actually changed inside a dependency before it reaches a build. That came out of a real supply chain compromise rather than a compliance checklist.
The gaps we are prioritizing
The useful version of this exercise is naming what does not work yet. Four gaps, stated plainly, with no dates attached because we are not going to invent them.
OT supply chain integrity is our weakest answer of the three in that objective. Firmware provenance and vendor attestation for industrial devices is a real gap. We decode what a device says. We do not yet speak to whether that device is carrying what its manufacturer shipped. Closing this is near-term work.
Asset discovery, as distinct from event parsing. The objective asks for asset visibility. Inventorying what exists on a process network through passive observation is a different capability from parsing events out of assets someone already told you about. We do the second well. We are investing in the first, because to a utility those are not the same claim.
"Real-time" is a phrase we are not going to borrow from the strategy. Our scheduled evaluation runs on an interval, and an interval is not real time. We would rather publish the measured latency than the adjective. Reducing it toward continuous evaluation is active work, and any buyer who tests the claim should find what we said they would find.
Ranking by operational consequence. We rank well by severity and exposure. Ranking by what a disruption would actually cost a specific operator is harder, and it is precisely where the strategy points. The National Risk Register named in that objective does not exist publicly yet. If it lands in a machine-readable form, consuming it to rank findings against national consequence is something we intend to do.
Pillar 1 asks defenders to "evict decisively" and to "keep critical operations running without interruption." On an industrial host those two instructions fight each other, because isolating a machine that drives a physical process is the outage. Our host agent carries the usual response actions, kill, isolate and quarantine, and on a laptop that is the end of the discussion. On a controller it is the start of one. Containment that removes an adversary without stopping the process is a different engineering problem, and we are treating it as one rather than pretending the standard playbook transfers.
We should be equally clear about the rest of Pillar 3. Regional advisor capacity, priority telecommunications over next-generation satellite constellations, and federal exercise programs are objectives aimed at CISA's own organization. We have no product story there. Inventing one would be the fastest way to signal we skimmed the document.
The clock that sets everyone's window
The strategy closes with three dated commitments. Read from an October 2026 publication, they frame the planning window for anyone aligning to this.
A programmatic review of CISA's core services and capabilities against the key objectives.
An approach for implementation and measurement of outcomes aligned to the pillars and objectives.
An update on progress against that implementation.
The middle one is the date to watch. Roughly April 2027 is when measurement criteria become public, and the moment any vendor's alignment claims stop being self-assessed. We would rather publish this read now, against the document, than rewrite it then against the scorecard.
There is no such thing as CISA 2030 compliance
Expect the badge anyway. It will be wrong. CISA 2030 sets direction for CISA. It creates no vendor obligation, no certification, no audit, and no conformance regime for anybody selling into critical infrastructure. Nobody can be compliant with it because there is nothing to be compliant against.
What can be claimed is narrower and more useful: state which objectives your capabilities serve, show the evidence, and name the ones you do not serve. That is the standard we have tried to hold above, and it is the standard worth applying to anyone else's claims, starting with the first datasheet that carries a CISA 2030 seal this quarter.
Three things. Reframe your program narrative from coverage to consequence, because that is the language your regulator and your board will inherit from this document. Assume compromise and ask whether you can evict an adversary from a process-critical host without causing the outage yourself, since the strategy now expects both. And treat April 2027 as a real date, because that is when alignment stops being a matter of opinion.
Questions about your exposure?
RedEye Security works with critical infrastructure and industrial operators on OT visibility, detection coverage, and the consequence-ranking question this strategy puts at the center. If you are rewriting a security program narrative to match where CISA is heading, that conversation is worth having before the measurement criteria land.