On October 26, 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) announced its new strategy, CISA 2030: Defend, Harden, Prevail.
The strategy focuses on three priorities: strengthening national cyber defense, protecting the infrastructure that matters most, and ensuring essential services can continue operating when attacks occur.
One aspect deserves particular attention. CISA wants to move beyond a defensive posture that primarily reacts to threats and towards identifying and removing adversary access before it can be used to disrupt critical infrastructure.
That is a significant objective. Detecting an intrusion after an attacker has established a foothold is important, but finding and removing that access before an attack causes disruption is a different challenge altogether.
Defend: Identify and Disrupt Threats Earlier
The first pillar focuses on strengthening national cyber defense through closer coordination between government agencies, infrastructure operators, technology vendors, and other partners.
CISA also plans to strengthen operational technology (OT) security, improve software security guidance, and address risks associated with emerging technologies.
For critical infrastructure operators, this matters because the consequences of a cyberattack extend beyond data theft. A compromised system could affect industrial operations, interrupt essential services, or create physical safety risks.
Consider an attacker who gains access to a utility’s network and remains undetected. The immediate concern is not necessarily whether data has been stolen. It is whether that access could eventually be used to interfere with operations.
Identifying suspicious access, investigating the affected systems, and removing the threat before it can cause disruption is central to the proactive approach CISA describes.
Harden: Protect What Matters Most
Not every system presents the same level of risk, and not every vulnerability deserves the same remediation priority.
CISA intends to place greater emphasis on risk-informed, consequence-based analysis, directing attention towards infrastructure whose disruption could have the greatest impact on national security, public safety, public health, and the economy.
This is particularly relevant to vulnerability management.
A critical vulnerability on an internet-facing, business-critical server may demand immediate action, especially when exploitation has been observed in the wild. Another vulnerability with a similar severity score might present a different level of risk because the affected system has limited exposure and no comparable operational importance.
Security teams should consider several factors when prioritizing remediation:
- Known exploitation: Is the vulnerability being actively exploited, or is there credible threat intelligence indicating imminent risk?
- Exposure: Is the affected asset accessible from the internet or reachable through a realistic attack path?
- Business criticality: Could compromising the asset interrupt an essential service or expose sensitive information?
- Attack paths: Could the vulnerability provide access to more sensitive systems or enable lateral movement?
- Remediation options: Is a patch available, and are effective compensating controls required while deployment is pending?
This approach does not mean ignoring vulnerabilities with lower scores. It means allocating resources according to the likelihood of exploitation and the consequences of compromise.
For organizations managing thousands of assets and findings, that distinction can significantly improve remediation decisions.
Prevail: Keep Essential Services Running
Even well-defended organizations can suffer successful intrusions. CISA’s third pillar recognizes the need to maintain essential services and recover when disruptions occur.
The strategy emphasizes critical infrastructure resilience, emergency communications, improved planning and exercises, and interoperable communications infrastructure.
For security teams, resilience needs to be demonstrated rather than assumed.
Backups are useful, but they do not establish whether an organization can restore a compromised service within an acceptable timeframe. Recovery may depend on identity systems, network infrastructure, external providers, and other systems that could also be affected during an attack.
Organizations should test whether critical services can be restored, validate their recovery dependencies, and establish clear decision-making responsibilities during incidents.
For OT environments, recovery planning must also account for operational safety. Restoring a system without validating its configuration and operational state could introduce additional risks.
The objective is to limit disruption and restore safe, reliable operations as quickly as possible.
What This Means for Enterprise Cybersecurity
Although CISA 2030 is a US national strategy, its priorities provide useful direction for enterprise security programmes.
Vulnerability management: Combine vulnerability severity with exploitation intelligence, asset exposure, and business impact. Prioritize vulnerabilities that create credible paths to significant disruption.
Threat intelligence: Connect intelligence about exploited vulnerabilities, malicious infrastructure, and attacker techniques to the organization’s own assets. The objective is to determine whether a threat is relevant and take action before the exposure becomes an incident.
Attack surface management: Maintain an accurate inventory of internet-facing assets, cloud resources, applications, and relevant OT systems. Reconcile discovery results with the CMDB and other asset records to identify unmanaged systems and ownership gaps.
OT security: Improve visibility into industrial environments, monitor suspicious activity, review remote access, and coordinate remediation with operational teams. Security changes must account for availability and safety requirements.
Cyber resilience: Test recovery procedures against realistic scenarios. Confirm that essential services can be restored even when identity infrastructure, privileged accounts, or supporting systems are compromised.
These are practical recommendations for enterprise teams, not new compliance requirements imposed by CISA 2030.
CISA’s Implementation Timeline
CISA has outlined three initial milestones for putting the strategy into practice:
- Within 60 days: Begin reviewing core services and capabilities against the strategy’s objectives.
- Within 180 days: Provide an implementation plan and establish how results will be measured.
- Within 365 days: Report progress on implementation.
These milestones provide an initial framework for assessing the agency’s progress. The effectiveness of the strategy will ultimately depend on how its priorities translate into operational capabilities and measurable improvements.
The Real Test for CISA 2030
The strategy sets a clear direction, but its success will depend on execution.
Identifying adversary access before it is used requires timely intelligence, sufficient visibility into critical systems, effective coordination with infrastructure operators, and the ability to act on findings. Resilience also requires sustained investment and recovery plans that work under real-world conditions.
For enterprise security leaders, the practical lesson is equally clear: knowing which vulnerabilities exist is not enough. Teams need to understand which exposures attackers can exploit, which systems could be affected, and what action will reduce the greatest risk.
CISA 2030 puts proactive defense, risk-based prioritization, and operational resilience at the centre of its strategy. The challenge now is turning those priorities into results.
