CISA’s North Star – Secure and Resilient Infrastructure

Summary: “Short and long-term goals are essential for every business to keep them motivated to fulfill their mission and vision. The same is true for cybersecurity. CISA has released its first Strategic Plan for 2023 – 2025 which acts like a north star not only for the Agency but also for all critical infrastructure organizations.”

Things don’t get done on their own. You can’t wish for a cyber-safe and secure organization before your nap and expect to wake up in this utopian world. Whether it is fitness goals or cybersecurity goals, you will have to set both short and long-term goals to achieve anything.

On the importance of setting goals

Still, it’s not always simple to achieve one’s goals. Only about 8% of people, for instance, succeed in keeping their New Year’s resolutions. Whether you’re trying to achieve something in your professional or personal life, you’ll inevitably face challenges. Timelines are the lifeblood of success, as any competent leader can tell you. If you don’t give yourself realistic deadlines, your plan has a very good chance of failing. It’s possible to exhaust yourself trying to achieve undefined objectives.

Setting objectives is critical to your professional and personal growth. Setting and working toward goals is a surefire way to maintain your focus, energy, and enthusiasm for the work at hand, as well as to guide your professional and personal growth. All of us talk about long-term and short-term planning when we discuss goal setting.

Long-term vs Short-term goals

Making plans for the future is the focus of long-term goals. Their completion usually takes longer than a year and necessitates a detailed strategy consisting of numerous steps or intermediate objectives. Since accomplishing them may take years, they must be flexible. For instance, new vulnerabilities appear, geopolitical events alter the status quo, technology improves, and criminals become more sophisticated virtually on a daily basis, all of which contribute to a constantly shifting cyber risk picture. Because change is the only constant, you’ll need to make adjustments.

Short-term objectives, on the other hand, are those that can be accomplished between now and a year from now. The goal is to complete some tasks quickly, such as implementing a fix for a known vulnerability in your OT systems or meeting a compliance audit threshold. Having a set of objectives to work toward is a terrific way to stay motivated. Due to the short duration, tasks can be completed rapidly. First and foremost, setting and achieving short-term goals provides you a feeling of accomplishment, which in turn can increase your confidence and motivate you to work toward making your organization more cyber resilient.

Your short-term goals should be a means to an end, serving your larger long-term objectives. It could be difficult to plan far in advance. You can avoid feeling overwhelmed by the task at hand by dividing your long-term goals into a series of SMART (Specific, Measurable, Achievable, Relevant, Timely) goals.

CISA’s Strategic Plan

Setting goals, both short and long-term ones, is a top priority not only for commercial businesses but also for agencies like the Cybersecurity and Infrastructure Security Agency, aka CISA. The agency released a strategic plan — a first in CISA’s four-year history. The 2023-2025 road map outlines the goals to guide the organization as it works to push the nation into a higher level of cybersecurity.

The Strategic Plan communicates the CISA’s mission and vision promotes the unity of effort across the agency and its partners, and defines success for CISA as an agency. It describes the stakeholder, policy, and operational context in which the Agency must perform and presents the strategic changes CISA will make to better execute its mission over the next three years.

CISA’s north star is a vision “where the cyber and physical infrastructure that Americans rely on every hour of every day is safe, secure, and resilient.” This vision also defines the Agency’s mission, “Lead the national effort to understand, manage, and reduce risk to our cyber and physical infrastructure.”

The Strategic Plan defines four long-term goals that will drive CISA to achieve its mission as a unified agency. Aligned with each goal are objectives – short-term goals – detailing how CISA will accomplish these goals and measure success.

CISA’s four long-term goals

CISA works with critical infrastructure partners every day to address the evolving threat landscape. Our increasingly interconnected, global cyberspace presents profound challenges in which we face cyber threats with large-scale, real-world effects. Regardless of mission, industry, or sector, all organizations share the same overarching concerns. These include increasing adversary sophistication and capability; an expanding cyberattack surface created through highly connected and interdependent technologies; and the need to rapidly increase the pool of highly skilled cyber talent for today and the foreseeable future.

With this in mind, the Strategic Plan sets CISA on a path over the next three years to drive change in four key areas:

1.) Spearhead the national effort to ensure the defense and resilience of cyberspace.

Serving as America’s cyber defense agency, CISA needs to coordinate the national effort to defend against cyber threat actors that target U.S. critical infrastructure, federal and local governments, the private sector, and the American people. To this end, CISA must lean forward in the cyber defense mission toward a collaborative, proactive risk reduction, working with partners to help mitigate the most significant cyber risks to the country’s national critical infrastructure, both as these risks emerge and before a major incident occurs.

2.) Reduce risks to, and strengthen the resilience of, America’s critical infrastructure.

Our safety and security depend on the ability of critical infrastructure to prepare for and adapt to changing conditions and to withstand and recover rapidly from disruptions. CISA coordinates a national effort to secure and protect against critical infrastructure risks. This national effort is centered around identifying which systems and assets are truly critical to the nation, understanding how they are vulnerable, and taking action to manage and reduce risks to them.

3.) Strengthen whole-of-nation operational collaboration and information sharing.

At the heart of CISA’s mission is partnership and collaboration. Therefore, it is essential that the Agency establish a forward-leaning, action-oriented collaboration with government, industry, academic, and international partners.

4.) Unify as One CISA through integrated functions, capabilities, and workforce.

This is an inward goal to help the Agency empower its people, building a culture of excellence based on core values and principles that prize teamwork and collaboration, innovation and inclusion, ownership and empowerment, and transparency and trust. Hence, the Agency has re-branded its acronym to read “Collaboration, Innovation, Service, Accountability.”

CISA’s Strategic Plan is an important document for every critical infrastructure organization. CISA’s long and short-term goals are also your “New Year’s Resolutions.” Reaching your goals is hard work. We get it and can help you.

Please visit our Contact Us page to request more information or connect with a Subject Matter Expert (SME).