CISA 2030 Sets Intelligence-Led Priorities for Critical Infrastructure Defense

The Cybersecurity and Infrastructure Security Agency (CISA) released its “CISA 2030: Defend, Harden, Prevail” strategy on October 26, 2026, outlining a more targeted approach to national cyber defense and critical infrastructure protection. The strategy directs CISA to use threat intelligence and the potential consequences of an intrusion to determine where agency assistance, investment, and operational effort should go. It calls for prioritizing infrastructure whose disruption could have the greatest effects on public safety, economic continuity, public health, and national security. CISA describes the intended shift as moving away from “threat-agnostic, all-hazards approaches” toward “risk-informed, consequence-based analysis.”

The roadmap establishes a series of near-term management milestones. CISA will begin reviewing its core services and capabilities within 60 days to determine how they support the strategy’s objectives; that is a deadline to start the review, not to finish it. Within 180 days, the agency plans to deliver an approach for implementing the strategy and measuring results, followed by a progress update within 365 days. The document does not identify which services may receive more or fewer resources, name specific programs for adjustment, or set out a procurement schedule. For contractors, the milestones are therefore indicators of agency planning and potential requirements development—not evidence of an open solicitation or a proposal deadline.

The strategy organizes its direction around three pillars: Defend, leading national cyber defense; Harden, prioritizing national infrastructure security; and Prevail, mobilizing national resilience. The stated priorities include operational technology protection, software security and supply-chain transparency, assessment of emerging technologies, infrastructure data analysis, and resilient emergency communications. CISA also calls for greater coordination with critical infrastructure owners and operators, government partners at multiple levels, industry, international organizations, and the intelligence community. Contractor capabilities in cyber threat intelligence, operational technology, asset visibility, anomaly detection, software assurance, supply-chain integrity, risk assessment, communications interoperability, and continuity planning may align with these priorities as CISA carries out its review.

The strategy arrives as CISA works to rebuild after workforce reductions that reportedly affected roughly a third of its staff. Acting Director Nick Andersen said in September that about 250 prospective employees had tentative offers and were awaiting clearance, with hiring focused on operational teams and regional personnel. The strategy also describes CISA’s responsibilities and priorities as having become “unclear,” although it does not identify particular services to change. Andersen emphasized the operational rationale for resilience: “The threat landscape we face today is not static. Nation-state actors and other malicious adversaries continue to grow more sophisticated in their efforts to compromise our networks, and there is no guarantee that a strong defense will eliminate intrusions.” He added that CISA must be prepared to “detect them quickly, evict them decisively, and keep critical operations running without interruption.” This framing points to a focus on response, recovery, and continuity alongside prevention. For industry, the most useful near-term step is to map existing offerings to the published objectives and monitor the agency’s review and implementation milestones; no contract value, procurement contact, or active buying opportunity is stated in the available reporting.

• CISA released “CISA 2030: Defend, Harden, Prevail” on October 26, 2026.
• The agency will begin reviewing core services and capabilities within 60 days; this is the review’s start deadline, not a completion deadline.
• CISA plans an implementation and measurement approach within 180 days and a progress update within 365 days.
• The strategy prioritizes intelligence-led, consequence-based decisions and infrastructure whose disruption could most affect public safety, the economy, public health, and national security.
• Named capability areas include operational technology security, software security, supply-chain transparency, emerging technology assessment, infrastructure data, and emergency communications resilience.
• CISA intends to improve asset visibility and anomaly detection and coordinate more closely with infrastructure owners and operators, government, industry, and intelligence partners.
• The three pillars are Defend (lead national cyber defense), Harden (prioritize infrastructure security), and Prevail (mobilize national resilience).
• Reporting says workforce reductions affected roughly a third of CISA’s staff; Andersen cited about 250 prospective employees awaiting clearance, with hiring focused on operational teams and regional personnel.
• Contractors can assess alignment in threat intelligence, risk assessment, OT security, software assurance, supply-chain integrity, and communications interoperability, while recognizing that no solicitation, contract value, or proposal deadline has been identified.