> CISA publishes strategy with eye on the next four years

The Cybersecurity and Infrastructure Security Agency published a strategy Monday that focuses on taking a leading role in cyber defense, prioritizing protection of critical infrastructure and building the ability to withstand attacks. The 10-page strategy — “CISA 2030: Defend, Harden, Prevail” —  largely reaffirms existing roles for the agency, but CISA will begin reviewing its core services and capabilities within 60 days to make sure they meet key objectives, followed by implementation over the next 180 days and an update on its progress after one year. Acting CISA Director Nick Andersen said in a foreword that the agency needs to act with “renewed purpose” in the face of threats. “The threat landscape we face today is not static,” he said. “Nation-state actors and other malicious adversaries continue to grow more sophisticated in their efforts to compromise our networks, and there is no guarantee that a strong defense will eliminate intrusions. As President Trump has reminded us, resilience must be the foundation of our approach. We must ensure that when adversaries gain a foothold, we are prepared to detect them quickly, evict them decisively, and keep critical operations running without interruption.” The strategy is also meant to align with the administration’s broader cyber strategy, published in March, and last year’s executive order on state and local preparedness. “I call on every company and organization in the critical infrastructure community — from owners and operators to vendors and technology manufacturers — to act now,” Andersen said in a comment released with the strategy. “CISA 2030 provides a focused roadmap to strengthen defenses, eliminate adversarial footholds, and deny them any advantage that could endanger the nation’s security, economy, or public health.” Within each section of the strategy, there are other goals listed. Under “defend: lead national cyber defense,” the key objectives are to integrate state, local and industry cyber defense; protect operational technology; developing guidance and best practices on software security; and assess and develop emerging technologies. Under “harden: prioritize national infrastructure security,” the key objectives are to coordinate intelligence for critical infrastructure; analyze infrastructure data; work with international partners; and emphasize strengthening the nation’s most important infrastructure. Under “prevail: mobilize national resilience,” the key objectives are to invest in critical infrastructure resilience; strengthen national communications interoperability; modernize planning and exercises; and build next-generation interoperable infrastructure. Critics say much of CISA has been badly diminished by budget cuts at the agency by the Trump administration, including many of them specifically a focus of the new strategy, that have left it understaffed. The last strategic plan at the agency, published in 2023, also had three pillars: address immediate threats, harden the terrain and drive security at scale. The post CISA publishes strategy with eye on the next four years appeared first on CyberScoop.