CISA 2030 strategy: what it says about AI and critical infrastructure

The short answer

The two CISA documents reviewed here do not describe the strategy as an AI strategy. The October 26, 2026 announcement and the strategy's resource page do not use the term AI when describing what CISA 2030 contains. The closest language is a commitment to "support secure emerging technologies." The announcement says CISA will work with public- and private-sector partners to strengthen the security and resilience of operational technology, advance software security, support secure emerging technologies, and improve continuity of National Security and Emergency Preparedness communications.

The strategy PDF itself was not among the documents reviewed. Anything the full text says about AI is therefore outside this explainer. What follows covers what the announcement and the resource page state, and what they tell critical-infrastructure leaders to expect.

What was released and when

CISA's press release carries the date October 26, 2026. It is titled as the release of CISA 2030: Defend, Harden, Prevail. The release says the Cybersecurity and Infrastructure Security Agency released its new strategy and that it advances President Trump's Cyber Strategy for America and National Resilience Strategy.

The separate resource page, which carries no date, describes the strategy as a roadmap. It says the strategy relies on strong partnerships, risk-informed action, and a commitment to securing the systems Americans depend on every day.

The three pillars

The press release states that the strategy has three pillars. These are Defend (Lead National Cyber Defense), Harden (Prioritize National Infrastructure Security) and Prevail (Mobilize National Resilience).

The release also describes the scope. It says CISA will strengthen security across the interconnected physical and cyber dimensions of critical infrastructure. It adds that cyber, physical and geopolitical threats increasingly intersect and can disrupt essential services Americans rely on every day.

The release also says the strategy covers emergency communications. It states that CISA's role in leading the initiation and restoration of National Security and Emergency Preparedness communications is reaffirmed.

Where AI appears in the documents

The announcement's only reference to new technology is the commitment to support secure emerging technologies, quoted above. It does not define "emerging technologies" and does not say whether that includes AI systems. This explainer does not read AI into that phrase.

AI does appear on the strategy's resource page, in a list of related resources. The list is a set of links that sit beside the strategy. The page does not say they are part of it. The list includes these titles:

• "Managing AI Token Consumption for Operational Resilience," listed with the date Oct 22, 2026.
• "Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation," listed with the date Oct 16, 2026.
• "Protecting Tokens and Assertions from Forgery, Theft, and Misuse: Implementation Recommendations for Agencies and Cloud Service Providers," listed with the date Sep 15, 2026.

The page labels the first two as external publications. Only titles and dates are visible in the material reviewed, so this explainer cannot say what the publications recommend. The titles do show that AI-related material was being listed next to the strategy in October 2026.

What CISA says it will do

The announcement describes a change in posture. It says CISA will move from a passive defense posture toward an aggressive, anticipatory stance focused on identifying, mitigating, and reducing malicious access to critical infrastructure.

It gives a reason in its description of the threat. The release says nation-state actors and other malicious adversaries are becoming increasingly sophisticated in their attempts to compromise U.S. networks.

The release names the agency's own capabilities as a focus. It says CISA will also improve its ability to prioritize risk, mobilize partners, and support rapid, coordinated action when threats emerge.

What to expect, and when

The announcement sets three deadlines for CISA's first year:

• Within 60 days: CISA will begin reviewing its core services and capabilities to meet key objectives.
• Within 180 days: CISA will provide a plan to implement the strategy and measure its results.
• Within 365 days: CISA will report on its progress in carrying out the strategy.

These deadlines bind CISA, not critical-infrastructure operators. The announcement does not impose requirements on companies. It does include a call to act. Acting Director Nick Andersen is quoted calling on every company and organization in the critical infrastructure community to act now, including owners and operators, vendors and technology manufacturers.

For security leaders, the documents support three expectations:

1. A review of CISA's services. The 60-day review of core services and capabilities could change what CISA offers to the sector. The announcement does not say what the review will change.
2. An implementation plan with measures. The 180-day plan is meant to include a way to measure results. That is the point at which specifics on priorities, including any on emerging technologies, may become visible. The announcement does not promise this.
3. A progress report. The 365-day report is the stated checkpoint for how CISA is carrying out the strategy.

The documents do not say that CISA 2030 creates AI-specific obligations, controls or reporting rules for operators. They also do not say how "secure emerging technologies" will be put into practice. Leaders who need the strategy's own wording on AI would have to read the full PDF listed on the resource page.