CISA released its new strategy on Oct 26, built on three pillars: Defend (lead national cyber defense), Harden (prioritize the most essential infrastructure) and Prevail (mobilize national resilience). It says CISA will move "from a passive defense posture toward an aggressive, anticipatory stance" focused on identifying and reducing malicious access to critical infrastructure, and will work on OT security, software security, emerging technology and emergency communications continuity.

The release has no new rules or funding. CISA says it will start reviewing its core services within 60 days and publish an implementation and measurement plan within 180 days. Acting Director Nick Andersen called on owners, operators, vendors and manufacturers to "act now". The practical impact on organizations is unclear until that plan appears.