CISA
CISA
CISA
CYBERSECURIT Y
ST R AT E G I C P L A N
FY2024–2026
C I S A C Y B E R S E C U R I T YC YS B
T RE ARTSE E
GCI CU PRLI ATNY A N D I N F R A S T R U C T U R E S E C U R I T Y A G E N C Y i
Contents
EXECUTIVE S UM MARY 01
OUR GOA L S A ND O B J E C TI V E S 06
GOA L 1 . A D D RE SS I M M E D I ATE TH R E AT S 08
1.1. Increase visibility into, and ability to mitigate, cybersecurity threats
and campaigns 09
1.2. Coordinate disclosure of, hunt for, and drive mitigation of critical and
exploitable vulnerabilities 10
1.3. Plan for, exercise, and execute joint cyber defense operations and
coordinate the response to significant cybersecurity incidents 11
GOA L 2. HA RDEN TH E TE R R A I N 13
2.1. Understand how attacks really occur — and how to stop them 14
2.2. Drive implementation of measurably effective cybersecurity
investments 15
2.3. Provide cybersecurity capabilities and services that fill gaps and help
measure progress 16
C ONC LUSION 23
A PPENDICES 24
Appendix 1. Alignment with the CISA Strategic Plan 25
Appendix 2. Alignment with the National Cybersecurity Strategy 28
C I S A C Y B ER S EC U RI T Y ST R AT EG I C PL A N I
EXECUTIVE
SUMMARY
Our nation is at a moment of opportunity. The 2023 U.S. National Cybersecurity Strategy
outlines a new vision for cybersecurity, a vision grounded in collaboration, in innovation, and in
accountability. Now is the moment where our country has a choice: to invest in a future where
collaboration is a default rather than an exception; where innovation in defense and resilience
dramatically outpaces that of those seeking to do us harm; and where the burden of
cybersecurity is allocated toward those who are most able to bear it. We must be clear-eyed
about the future we seek, one in which damaging cyber intrusions are a shocking anomaly, in
which organizations are secure and resilient, in which technology products are safe and
secure by design and default. This is a shared journey and a shared challenge, and CISA, as
America’s cyber defense agency, is privileged to serve a foundational role in the global
cybersecurity community as we achieve measurable progress to our shared end state.
We know that the stakes are high. Our nation relies on connected technologies every hour of
every day to enable essential services, from drinking water to electricity to financial systems. In
recent years, this dependence has deepened even further, as many Americans now rely on
connectivity for most aspects of their daily lives. Malicious cyber actors recognize our
dependence on technology and constantly attempt to exploit this reliance for financial or
strategic gain. Too often, they succeed. Their success is enabled by an environment of
insecurity, in which our enterprises are too difficult to defend, and our technology products are
too vulnerable to protect.
But we also know the steps to take. We must change how we design and develop technology
products, such that exploitable conditions are uncommon and secure controls are enabled
before products reach the market. We must quickly detect adversaries, incidents, and
vulnerabilities, and enable timely mitigation before harm occurs. We must help organizations,
particularly those that are “target rich, resource poor,” take the fewest possible steps to drive
the most security impact. Recognizing that we will not prevent every intrusion, we must ensure
that our most essential services are resilient under all conditions, with particular focus on
under-resourced communities where loss of key services can have the greatest impact. Most
importantly, we must do it together, recognizing that true collaboration is the only path toward
a more secure future.
C I S A C Y B ER S EC U RI T Y ST R AT EG I C PL A N 1
To this end, our Cybersecurity Strategic Plan outlines three enduring goals:
GOA L 1: A DDRESS IMME D IATE TH R E AT S. We will make it increasingly difficult for our
adversaries to achieve their goals by targeting American and allied networks. We will work with
partners to gain visibility into the breadth of intrusions targeting our country, enable the
disruption of threat actor campaigns, ensure that adversaries are rapidly evicted when intrusions
occur, and accelerate mitigation of exploitable conditions that adversaries recurringly exploit.
As we progress toward these goals, we must embody the hacker spirit, thinking creatively and
innovating in every aspect of our work. The ongoing work of CISA’s workforce—our threat hunters,
vulnerability analysts, operational planners, regionally deployed cybersecurity advisors, and
others—epitomize this collaborative spirit.
Each day, our team members work shoulder to shoulder with the cybersecurity community to
address our most pressing cyber risks. We know we cannot achieve lasting security without
close, persistent collaboration among government, industry, security researchers, the
international community, and others. Even as we are accountable for national cybersecurity, we
must align accountability across the ecosystem, such that cybersecurity is considered a
foundational business risk at every organization and technology manufacturers prioritize product
safety. Cyber incidents have caused too much harm to too many American organizations.
Working together, we can change this course. Working together, we can create a new model. We
know the path and we’ve collectively begun the right steps. Now is the time to focus, prioritize,
and accelerate — recognizing that our adversaries are not going to wait.
C I S A C Y B ER S EC U RI T Y ST R AT EG I C PL A N 2
Our Strategic Intent
In alignment with the 2023 National Cybersecurity Strategy and the Fiscal Year 2023 – 2025
CISA Strategic Plan, this CISA Cybersecurity Strategic Plan describes how we will execute
our cybersecurity mission and advance our cybersecurity capabilities. Within CISA, this Plan
will serve as a keystone for implementation, resource, and operational planning, as further
executed through our Annual Operating Plans. Externally, it will help stakeholders understand
and participate in our long-term cybersecurity planning and prioritization.
As we implement our Strategic Plan, changes to the threat and technology environments may
require periodic re-evaluation of strategic priorities. However, the fundamental security shifts
toward which we will drive, and the long-term investments defined by this Plan will endure.
C I S A C Y B ER S EC U RI T Y ST R AT EG I C PL A N 3
CISA’s approach to cybersecurity is grounded in five fundamental precepts:
C I S A C Y B ER S EC U RI T Y ST R AT EG I C PL A N 4
FE D E R A L TA RG E T- RI C H
AG E N C I E S RE SO U RC E - P O O R
C RI T I CA L KE Y T EC H N O LO GY
I N FR A S T RU C T U RE PROV I D E RS
F I G U R E 1 . Priority Stakeholders
importantly, our success is based on the trust of our partners. At every turn, we will prioritize
maintaining trusted relationships that allow us to serve as a unique partner and source of
expertise. We also recognize that cybersecurity is a whole-of-society mission, in which every
individual and organization has a role to play.
PRIORITIZE OUR RES O URC E S WITH R IGO R A N D H UM ILI T Y: Like any organization,
CISA’s resources are finite, and we must prioritize our actions to achieve the greatest impact for
the American people. We will focus our activities on four broad sets of stakeholders: (1) federal
civilian executive branch agencies, where we maintain unique authorities and capabilities;
(2) target rich, resource poor entities where federal assistance and support is most needed,
including SLTT partners and our nation’s election infrastructure; (3) organizations that are
uniquely critical to providing or sustaining National Critical Functions, leveraging the analytic
capabilities of our National Risk Management Center; and (4) technology and cybersecurity
companies with capability and visibility to drive security at scale, including the Industrial
Control System and Operational Technology communities. While we will not limit our support
and engagement to these groups, prioritization will allow us to make prudent tradeoffs where
necessary to maximize our contributions.
C I S A C Y B ER S EC U RI T Y ST R AT EG I C PL A N 5
CISA’S CY BERSEC URIT Y
C I S A C Y B ER S EC U RI T Y ST R AT EG I C PL A N 6
V ISIO N
Secure and resilient
infrastructure for the American people.
M ISSI O N
Lead the national effort to understand, manage, and reduce risk to our cyber
and physical infrastructure.
G OA L 1 GOAL 2 GOAL 3
CISA C O R E PR IN C IPLE S
People First • Do The Right Thing. Always • Lead With Empathy • Seek And Provide Honest Feedback • Communicate
Transparently And Effectively • Foster Belonging, Diversity, Inclusion, And Equality • Imagine, Anticipate, And Innovate To Win •
• Make It Count • Build And Cultivate Your Network • Play Chess • Stand In The Arena • Commit To A Lifetime Of Learning
CI SA CORE VA LUES C O L L A B O R A T I O N || I N N O V A T I O N || S E R V I C E || A C C O U N T A B I L I T Y
To the contrary, our work to address immediate threats will enable us to prioritize investment
in the security controls, measures, and capabilities that most effectively reduce risks. In turn,
as we provide guidance and services that help organizations reduce their enterprise risk, we
will be able to more clearly define the attributes of a safe and secure technology product.
Finally, as we advance security across the product lifecycle, we will force threat actors to adopt
more time-consuming and expensive tactics, reducing the prevalence of attacks. It is only
through this virtuous cycle that we will make necessary progress.
C I S A C Y B ER S EC U RI T Y ST R AT EG I C PL A N 7
GOAL 1
Address Immediate
Threats
C I S A C Y B ER S EC U RI T Y ST R AT EG I C PL A N 8
OB JEC TIVE 1 .1
Increase visibility into, and ability to mitigate,
cybersecurity threats and campaigns
Today, our cybersecurity community, CISA included, lacks visibility of necessary breadth and
depth into cybersecurity intrusions and adversary campaigns. We must achieve the ability to
rapidly detect adversary activity and enable rapid eviction, denying malicious actors the
persistent access they often seek, whether on-premises or in the cloud. We will achieve this
visibility by all available means: through our own sensors and capabilities; by leveraging
commercial and public data sources, and by partnering with the private sector, government
agencies, and international allies. Our necessary gains in operational visibility must be
underpinned by state-of-the-art tools, modern analytic infrastructure, trusted partnerships, and
the world’s best analytic workforce. All this data must be seamlessly integrated across CISA and
rapidly shared in real-time in a machine-readable manner with government, private sector, and
international partners to provide operators with accurate, actionable information — a vision we
will execute leveraging the Joint Collaborative Environment. Working collaboratively with our
partners, we must identify and mitigate threat campaigns before significant damage occurs.
C I S A C Y B ER S EC U RI T Y ST R AT EG I C PL A N 9
OB JEC TIVE 1 . 2
Coordinate disclosure of, hunt for, and drive
mitigation of critical and exploitable vulnerabilities
Most intrusions today are perpetrated using known vulnerabilities or exploiting weak security
controls. This makes life too easy for our adversaries. As a nation, we must urgently progress
to a model in which pervasive vulnerabilities and security weaknesses in critical infrastructure
and government networks are considered intolerable. While much progress in this area must
be driven through deployment of technology that is safe and secure by design and default,
we will also take near-term steps to reduce the prevalence of exploitable vulnerabilities
by providing authoritative instruction on prioritized mitigations, hunting for exploitable
vulnerabilities in domestic networks, and using all possible levers to widely publicize and drive
remediation. We must gain a persistent understanding of vulnerabilities across our nation’s
critical infrastructure and government networks in order to enable more timely remediation
before intrusions occur. We must also encourage, catalyze, and support the security research
community and product security teams to ensure that vulnerabilities are discovered and fixed
before adversaries can use them to cause harm. The uncoordinated or premature disclosure
of significant vulnerabilities can lead to opportunities for easy exploitation by threat actors
across all sectors of government and the economy. To this end, we will work closely with
vendors, integrators, system owners, the security research community, and other key partners
to incentivize identification and reporting of previously unknown vulnerabilities, enable timely
and coordinated vulnerability disclosure, and drive mitigation before compromise occurs.
C I S A C Y B ER S EC U RI T Y ST R AT EG I C PL A N 10
ENA BL ING MEA SURE
1 | We will measure the breadth of our 2 | We will increase trust and collaboration
visibility into vulnerabilities, particularly those with the research community and the private
known to be exploited by adversaries, across sector by expanding participation in
critical infrastructure and government Coordinated Vulnerability Disclosure efforts.
networks, whether through our own
capabilities or that of our partners.
OB JEC TIVE 1 . 3
Plan for, exercise, and execute joint cyber defense
operations and coordinate the response to
significant cybersecurity incidents
No single organization can effectively manage, understand, and address the breadth of cyber
incidents and threats facing our country. Through our Joint Cyber Defense Collaborative and
our expanding regional teams, we will serve as an integrator and force multiplier, bringing
together government, private sector, and international partners to measurably reduce cyber
risk. We will invest in persistent collaboration defined by reciprocal expectations of
transparency and value and minimizing friction to enable scale and data-driven analysis. We
will develop, exercise, and execute cyber defense plans that enable effective responses to
urgent threats while retaining focus on longer-term risks that require sustained investment. To
C I S A C Y B ER S EC U RI T Y ST R AT EG I C PL A N 11
most effectively realize our collaboration and planning capabilities, we will update, exercise,
execute, and maintain the National Cyber Incident Response Plan (NCIRP) to ensure that the
breadth of our nation’s capacity is effectively coordinated and leveraged in reducing the
impact of cyber incidents. We will accelerate coordination with our government partners that
maintain the ability to impose costs on our adversaries so that decisions to target American
networks are met with appropriate consequences. Recognizing the borderless nature of cyber
defense, we will maximize our role as America’s Computer Emergency Response Team (CERT)
to serve as an operational exemplar to the international community and forge a coalition of
national cyber defense organizations to act in concert in protecting against shared threats.
C I S A C Y B ER S EC U RI T Y ST R AT EG I C PL A N 12
GOAL 2
C I S A C Y B ER S EC U RI T Y ST R AT EG I C PL A N 13
OB JEC TIVE 2.1
Understand how attacks really occur — and how to
stop them
Every organization has a finite cybersecurity budget, but the ways to expend such limited
resources are nearly infinite. CISA must inform, guide, and drive adoption of the most
impactful cybersecurity measures by first understanding how attacks occur — not just the initial
access, but how the attacker exploited a web of unsafe technology products and inadequate
security controls to achieve their objective. We will base this understanding on a variety
of sources, including our own visibility into federal civilian executive branch systems, our
partners’ visibility into critical infrastructure systems, insights from the research community,
and incident reporting — voluntary today and supplemented by mandatory reporting under
the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) in future years.
We will focus on understanding how the success achieved by attackers differs by sector or
organizational profile, and whether such differences are caused by factors such as a lack
of resources, information, or expertise that CISA and our partners can help rectify. This
knowledge is a prerequisite for us to proactively drive pro-security decisions and inform and
justify security decisions made by all levels of government and across the private sector.
C I S A C Y B ER S EC U RI T Y ST R AT EG I C PL A N 14
OB JEC TIVE 2. 2
Drive implementation of measurably effective
cybersecurity investments
We must provide timely, accurate, actionable, and achievable guidance that helps
organizations prioritize investment in controls and mitigations that address how attacks
actually occur and how adversaries are evolving. For federal civilian executive branch agencies,
we will fully exercise our directive authorities to drive toward a common security baseline and
execute agency improvement plans to address tailored gaps. We will ensure that our guidance
remains relevant in a changing technology environment, with particular focus on ensuring
secure adoption of cloud computing resources. For organizations across the country, we will
provide guidance that supports prudent investment, including machine-readable technical
information by default. At the center of these efforts are the Cybersecurity Performance
Goals (CPGs), which can help critical infrastructure and other entities make risk management
decisions that achieve high-priority security outcomes and consider aggregate risk to the
nation. We will work with a variety of partners across government and industry to promote
adoption and take steps to align incentives that address constraints limiting further progress.
C I S A C Y B ER S EC U RI T Y ST R AT EG I C PL A N 15
OB JEC TIVE 2. 3
Provide cybersecurity capabilities and services that
fill gaps and help measure progress
Our nation benefits from a robust commercial market for cybersecurity capabilities and
services, which CISA cannot and will not seek to supplant or duplicate. Instead, CISA will
provide modern cybersecurity capabilities and services in three cases: (1) for federal
civilian executive branch agencies, where our authorities and resources enable provision
of centralized and shared services that offer necessary visibility, expedited risk reduction,
and significant cost savings; (2) for target rich/resource poor organizations, where limited
resources and sustained adversary interest provide a compelling justification for government
assistance to the degree our authorities allow; and (3) to measure the state of American
cybersecurity and associated trends, which is necessary to guide actionable and impactful
information sharing, guidance, and direction.
In the first case, this will include continuing to expand and modernize the Continuous
Diagnostics and Mitigation program, which now provides extraordinary visibility across nearly
every federal civilian executive branch agency and enables host-level persistent hunting
and response, and our Cybersecurity Shared Services Office, which provides a broadening
portfolio of commercial services from Protective DNS Resolution to Vulnerability Disclosure
Platforms. In the second case, we will provide cybersecurity assessments and, in cases
where our authorities allow us, shared services that meet identified capability gaps and are
C I S A C Y B ER S EC U RI T Y ST R AT EG I C PL A N 16
consumable by our partners, guiding target rich/resource poor entities to alternative providers
when necessary, benefitting from relationships and scale offered by our regional teams.
In the final category, we will leverage commercial Attack Surface Management and similar
capabilities to both help our partners identify exploited or exploitable conditions and gain a
better picture into security trends across the country. In all cases, our strong bias will be to
leverage commercially-available tools and services; only when no viable capabilities exist in
the commercial market will we consider developing an in-house capability. Our capabilities and
services will be designed with scalability as a top priority, leveraging the breadth and capability
of our regional cybersecurity workforce and focusing on delivering measurable value to every
participating partner. These capabilities will be underpinned by modern analytic infrastructure,
executed through our Cyber Analytics and Data System (CADS) for our own operators and
expanding into the Joint Collaborative Environment (JCE) to incorporate data and analysis from
our partners across government and the private sector.
C I S A C Y B ER S EC U RI T Y ST R AT EG I C PL A N 17
GOAL 3
C I S A C Y B ER S EC U RI T Y ST R AT EG I C PL A N 18
OB JEC TIVE 3.1
Drive development of trustworthy technology
products
As noted in the National Cybersecurity Strategy, “poor software security greatly increases
systemic risk across the digital ecosystem and leaves Americans bearing the ultimate cost.”
We will partner with like-minded organizations across government and industry to drive
progress toward a world in which a technology product must be safe before it can be sold.
We will focus first on defining what it means for a technology product to be safe and secure,
collaboratively developing guidance and technical criteria to help customers choose safe
products and manufacturers to deliver accordingly. Recognizing that technology manufacturers
will need to prioritize areas for improvement, we will take a data-driven approach to identify
those practices that drive down the most risk and address entire classes of attacks, such as
using memory safe coding languages. We will take steps to advance transparency, including
through adoption of Software Bills of Materials and rigorous vulnerability disclosure practices.
Even as we maintain our voluntary, trust-based model of collaboration, we will strive to ensure
that regulators and other government entities with compulsory authorities leverage technically
sound and effective practices developed together with our partners across the private sector,
ideally enabling harmonization across both U.S. and global regulatory regimes.
C I S A C Y B ER S EC U RI T Y ST R AT EG I C PL A N 19
MEA SURE OF EFFEC TI V E N E SS
1 | Increase in the number of technology 4 | Increase in the number of technology
providers that have published detailed providers that have published a secure-by-
threat models, describing what the creators design roadmap, including how the provider
are trying to protect and from whom. is making changes to their software
development processes, measuring defect
2 | Increase in the number of technology rates, and setting goals for improvement,
providers that have regularly and publicly and transitioning to memory-safe
attested to implementation of specific programming languages.
controls in the Secure Software
Development Framework (SSDF). 5 | Increase in the number of technology
providers that regularly publish security-
3 | Increase in the number of technology relevant statistics and trends, such as MFA
providers that have published a adoption, use of unsafe legacy protocols,
commitment to ensure that product CVE and the percentage of customers using
entries are correct and complete. unsupported product versions.
OB JEC TIVE 3. 2
Understand and reduce cybersecurity risks posed
by emergent technologies
The current technology environment poses of a variety of cybersecurity challenges: widespread
use of products no longer supported by their vendor, complex network architectures that
create gaps for adversaries, resource constrained organizations that are unable to deploy
modern security controls. Even as we address these characteristics that challenge nearly
every organization, we must recognize that the technology environment of the near future
may present even great risks. While we collectively cannot predict the future technology
environment with precision, we know that AI and cryptanalytically-relevant quantum computers
(CRQCs) will fundamentally change aspects of how we secure our critical data and systems
from cybersecurity threats. We will collaboratively work to ensure that our own work benefits
from responsible use of emergent technologies, that we help the developers of emergent
technologies protect their systems and data from malicious use, and that we help protect
organizations from adversarial use of these technologies.
C I S A C Y B ER S EC U RI T Y ST R AT EG I C PL A N 20
ENA BL ING MEA SURE
We will provide guidance and support to help organizations understand, leverage, and reduce
harms that accrue from malicious use of AI, CRQCs, and other emergent technologies.
OB JEC TIVE 3. 3
Contribute to efforts to build a national cyber
workforce
Our nation remains challenged by intersecting gaps: a shortage of qualified candidates for
many cybersecurity roles and a profound lack of diversity in the cybersecurity workforce.
Addressing these gaps remains a challenge for cybersecurity teams across the country,
in many ways posing a risk to national security. We will work closely with the Office of
the National Cyber Director (ONCD) to implement a national cybersecurity workforce and
education strategy. We will seek opportunities to bolster the national cyber and cyber-adjacent
workforce — focusing both on ensuring the current cybersecurity workforce has the skills
needed for a changing risk and threat environment and expanding the pipeline for the future
workforce, from “K to Gray.”
C I S A C Y B ER S EC U RI T Y ST R AT EG I C PL A N 21
ENA BL ING MEA SURE
We will invest in programs and initiatives in support of the National Cybersecurity Workforce
Strategy that both support a current cybersecurity workforce that meets the challenges of
today and helps build a deep and diverse workforce of tomorrow.
C I S A C Y B ER S EC U RI T Y ST R AT EG I C PL A N 22
Conclusion
The next three years will set a new course for CISA and for national cybersecurity. It is a bold
and expanded path, but this work is essential to a safe and secure cyberspace for all
Americans. Given the untenable cyber risks our country, our businesses, and our communities
face, we have no other choice. Together with our partners, we hope to look back on 2023 as the
point when the trajectory of national cybersecurity risk began to change for the better.
Through the implementation of this strategy, we will first focus our efforts and energy to ensure
our core cybersecurity functions are executed to the greatest effect. We must get the
fundamentals right. We will optimize our cyber defense operations to identify, prevent, and
address acute threats and vulnerabilities, and mitigate incidents more quickly. We will provide
innovative shared services to directly address risks as well as actionable and practical guidance
that helps defenders prioritize investments to address the most likely and impactful threats.
But we know this is not enough. We will drive progress toward a future where technology is
purposely designed, built, tested, and maintained to significantly reduce the number of
exploitable flaws before it is introduced to the market for broad use. We will take steps to shift
the burden for security to those who can bear it.
And we will do to it together. The risks are severe and mounting, the hurdles are high. But they
are surmountable. Through our shared efforts, we will shift the arc of national risk and create a
safer future for generations to come.
C I S A C Y B ER S EC U RI T Y ST R AT EG I C PL A N 23
Appendices
C I S A C Y B ER S EC U RI T Y ST R AT EG I C PL A N 24
APPENDIX 1
Alignment with the CISA Strategic Plan
C I S A C Y B ER S EC U RI T Y ST R AT EG I C PL A N 25
APPENDIX 1
3.1. Optimize collaborative planning and 1.3. Plan for, exercise, and execute joint cyber defense
implementation of stakeholder engagements and operations and coordinate the response to significant
partnership activities cybersecurity incidents
1.3. Plan for, exercise, and execute joint cyber defense
operations and coordinate the response to significant
3.2. Fully integrate regional offices into CISA’s cybersecurity incidents
operational coordination
2.3. Provide cybersecurity capabilities and services
that fill gaps and help measure progress
1.3. Plan for, exercise, and execute joint cyber defense
3.3. Streamline stakeholder access to and use of
operations and coordinate the response to significant
appropriate CISA programs, products, and services
cybersecurity incidents
C I S A C Y B ER S EC U RI T Y ST R AT EG I C PL A N 26
APPENDIX 1
3.3. Streamline stakeholder access to and use of 2.3. Provide cybersecurity capabilities and services
appropriate CISA programs, products, and services that fill gaps and help measure progress
1.1. Increase visibility into, and ability to mitigate,
cybersecurity threats and campaigns
1.2. Coordinate disclosure of, hunt for, and drive
mitigation of critical and exploitable vulnerabilities
1.3. Plan for, exercise, and execute joint cyber defense
3.4. Enhance information sharing with CISA’s
operations and coordinate the response to significant
partnership base
cybersecurity incidents
2.1. Understand how attacks really occur — and how to
stop them
2.2. Drive implementation of measurably effective
cybersecurity investments
1.3. Plan for, exercise, and execute joint cyber defense
3.5. Increase integration of stakeholder insights to operations and coordinate the response to significant
inform CISA product development and mission cybersecurity incidents
delivery 2.3. Provide cybersecurity capabilities and services
that fill gaps and help measure progress
C I S A C Y B ER S EC U RI T Y ST R AT EG I C PL A N 27
APPENDIX 2
Alignment with
the National Cybersecurity Strategy
C I S A C Y B ER S EC U RI T Y ST R AT EG I C PL A N 28
APPENDIX 2
3.2. Drive the development of secure internet of 3.1. Drive development of trustworthy technology
things devices products
1.2. Coordinate disclosure of, hunt for, and drive
3.3. Shift liability for insecure software products and mitigation of critical and exploitable vulnerabilities
services 3.1. Drive development of trustworthy technology
products
C I S A C Y B ER S EC U RI T Y ST R AT EG I C PL A N 29
APPENDIX 2
C I S A C Y B ER S EC U RI T Y ST R AT EG I C PL A N 30
APPENDIX 2
C I S A C Y B ER S EC U RI T Y ST R AT EG I C PL A N 31
APPENDIX 2
C I S A C Y B ER S EC U RI T Y ST R AT EG I C PL A N 32
CYBERSECURIT Y AND INFRASTRUCTURE SECURIT Y AGENCY
CISA CYBERSECURIT Y
ST R AT E G I C P L A N
FY2024–2026
O N E C I S A : C O L L A B O R AT I O N , I N N O VAT I O N , S E R V I C E , A C C O U N TA B I L I T Y
C I S A C Y B ER S EC U RI T Y ST R AT EG I C PL A N 33