CISA 2030: US strategy bets on detection and resilience
CISA publishes CISA 2030: three pillars, OT, software security and 60- and 180-day deadlines. What changes and what European companies should do.
On Monday, 26 October 2026, the Cybersecurity and Infrastructure Security Agency (CISA) published “CISA 2030: Defend, Harden, Prevail”, the strategy that will guide its work over the next four years. According to CyberScoop, the 10-page document largely reaffirms the roles already assigned to the agency; Infosecurity Magazine stresses that it puts rapid detection and response and the continuity of critical services ahead of “passive defense”. Help Net Security describes an “anticipatory” approach, aimed at identifying and reducing malicious access already present in critical infrastructure.
The principle: plan for the intrusion
CISA Acting Director Nick Andersen says so in the foreword reported by CyberScoop: a strong defense does not guarantee that intrusions are eliminated. That is why organisations must be ready to detect intruders quickly, evict them decisively and keep critical operations running without interruption. Andersen calls on the whole critical infrastructure community, from owners and operators to vendors and technology manufacturers, to “act now”.
It is a shift in emphasis more than in substance: the yardstick is no longer prevention alone, but how long an attacker stays in the network and the ability to keep working while removing them.
The three pillars
Defend: lead national cyber defense. The objectives listed by CyberScoop are integrating state, local and industry cyber defense, protecting operational technology (OT), developing guidance on software security and assessing emerging technologies. Help Net Security adds detail on OT: modernising operational environments, improving asset visibility and anomaly detection, and strengthening supply chain integrity and software transparency. Among emerging technologies, according to Help Net Security, the strategy mentions “superintelligence” and quantum computing.
Harden: prioritize national infrastructure security. The goal here is to coordinate intelligence for critical infrastructure and turn it into operational action, with investment in tools for real-time decisions and alerts. Analysis of infrastructure data will be used to set priorities and focus resources where they have the most impact; work with international partners and particular attention to the most important infrastructure are also planned.
Prevail: mobilize national resilience. This pillar covers investment in resilience, interoperability of emergency communications and the modernisation of planning and exercises. Help Net Security reports that advisors in CISA’s ten regional offices will be equipped to support both cyber and physical security, and that the strategy includes support for priority telecommunications, including 5G and 6G networks and commercial satellite constellations, as well as investment in encrypted, scalable and resilient infrastructure.
Timeline and context
Both outlets that report the timeline indicate a review of the agency’s core services and capabilities within 60 days and a progress report after one year. On the intermediate step the sources differ: CyberScoop speaks of implementation over the following 180 days, while Help Net Security mentions a plan, within 180 days, setting out implementation and measures of success.
According to CyberScoop, the strategy is aligned with the national cyber strategy published in March and with last year’s executive order on state and local preparedness. The previous plan, from 2023, also had three pillars: address immediate threats, harden the terrain and drive security at scale. Only CyberScoop reports the criticism: budget cuts decided by the administration are said to have left the agency understaffed, including in areas the new strategy focuses on.
What it means for European and Italian companies
The strategy has no direct effect in Europe, but two aspects matter here too:
- CISA guidance and advisories, including the Known Exploited Vulnerabilities (KEV) catalog, are used by many European security teams: more focus on OT, supply chain and software means more practical guidance on these topics;
- Andersen’s call explicitly addresses vendors and technology manufacturers: European companies selling products or services to US critical infrastructure operators are part of the strategy’s audience.
The approach is close to that of NIS2. Article 21 of the directive, transposed in Italy by Legislative Decree 138/2024, requires measures for incident handling, business continuity and crisis management, supply chain security and vulnerability handling. In energy, water, transport and healthcare, where OT systems and devices sit alongside office IT, asset visibility and anomaly detection are the starting point.
What to do now
- Measure detection and response times: how long it takes you to notice anomalous access and shut it down, and whether you have an eviction procedure (credential resets, removal of persistence, review of privileged accounts).
- Inventory your assets, OT included, and check the separation between the office network and the operational network; map detections to the MITRE ATT&CK for ICS matrix where relevant.
- Ask your suppliers how they handle vulnerabilities, whether they provide a software bill of materials (SBOM) and how quickly they fix exploited flaws.
- Bring intelligence into decisions: use the KEV catalog and agency advisories to set the order of updates.
- Exercise business continuity, including scenarios with loss of communications and alternative channels already tested.
- Take stock of the cryptography in use, as a first step towards post-quantum migration.
How ARXDOME helps
ARX Sentry collects events and inventory from computers, servers and firewalls and shows them in the SOC pages, with MITRE ATT&CK tactics per machine: the basis for spotting an intrusion early. ARX Watch finds devices on the network that have no probe, which often escape inventories. ARX Shield highlights vulnerabilities already exploited and lets you isolate a suspicious machine from the network, while ARX Horizon enriches every event with threat intelligence.
Last updated:
