CISA 2030: What the New U.S. Cyber Strategy Means for OT, Legacy PLCs and Spare-Parts Planning

On 26 October 2026 the Cybersecurity and Infrastructure Security Agency released CISA 2030: Defend, Harden, Prevail. The strategy reorients the agency away from broad, all-hazards coverage and toward intelligence-driven, consequence-based prioritisation: CISA will focus attention, investment and operational effort on the infrastructure whose disruption would do the most damage to national security, the economy, public health and safety. For anyone who runs, maintains or buys parts for industrial control systems, that is not an abstract policy shift. It puts operational technology (OT), unsupported controllers and the spare-parts chain that keeps them running squarely inside the national risk conversation.

Key takeaways

• CISA 2030 is built on three pillars: Defend (lead national cyber defense), Harden (prioritise national infrastructure security) and Prevail (mobilise national resilience).
• The agency says it will move from passive defense to an aggressive, anticipatory stance and will "actively eliminate adversarial footholds in defense-critical infrastructure prior to weaponization against our systems".
• The Harden pillar explicitly deprioritises threat-agnostic, all-hazards approaches in favour of risk-informed, consequence-based analysis, and CISA will help develop a National Risk Register.
• OT is a named objective, not a footnote: CISA commits to helping operators modernise OT environments, improve asset visibility and anomaly detection, and assure OT supply-chain integrity. Software security and supply-chain transparency get their own objective.
• CISA set three public milestones: a core-capability review within 60 days, an implementation and measurement plan within 180 days, and a progress report within 365 days.

What CISA 2030 actually says

The document is short and unusually direct. It frames cyber, physical and geopolitical threats as intersecting, says adversaries are seeking persistent access that can be used later, and argues that CISA's scope had become too broad to be effective. The three pillars are a way of narrowing the agency's work.

The strategy is aligned with Cyber Strategy for America (March 2026), the 2026 National Resilience Strategy and Executive Order 14239, as cited in the document. It also reaffirms CISA's role in initiating and restoring National Security and Emergency Preparedness communications. In other words, the resilience language is not decorative: communications continuity and recovery are part of the same programme as cyber defense.

The real change is less spread, not more security

The most consequential sentence in the strategy sits under Harden. CISA says it will "deprioritize threat-agnostic, all-hazards approaches and embrace risk-informed, consequence-based analysis to focus attention, investment, and operational effort on the infrastructure whose disruption would have the greatest impact on public health and safety, continuity of the economy, and national security".

That is a resource-allocation doctrine. It does not mean that low-consequence assets are safe, or that private operators can ignore them. It means CISA's own programmes, guidance, incident support and assessment attention will be tiered. The agency also says it will support the White House in developing a National Risk Register to quantify risk to national infrastructure.

For a manufacturer, the practical translation is a three-part test applied to every control system: what stops, for how long, and who feels it. An extrusion line that feeds a single automotive customer is not the same as a water-treatment pump station, even if both run the same PLC family. Under a consequence-based model, the difference in criticality should drive the difference in segmentation, monitoring, spare holdings and recovery testing.

CISA 2030 does not create new legal obligations for private companies by itself. It is a strategy for how the agency will spend its own effort and influence. But it changes the questions that will be asked in incident response, sector exercises, grant programmes and procurement reviews. The operators who can answer those questions in writing will be better positioned than those who cannot.

Why this lands hardest on OT and legacy control systems

OT appears in the Defend pillar as a standalone objective. CISA says it will work with owners and operators to modernise OT environments, improve asset visibility and anomaly detection, and assure OT supply-chain integrity. That is a fair description of the gap in most brownfield plants.

The average industrial control system is not a cloud service. It is a mix of controllers commissioned before the smartphone existed, HMIs running older Windows builds, serial links converted to Ethernet, and remote-access paths installed for OEM support and never reviewed. Many of these assets cannot run an endpoint agent, cannot be patched without a production window, and have no meaningful authentication or logging. The strategy's own framing recognises the convergence problem: cyber and physical dimensions "can no longer be treated as separate domains".

"Modernise OT" is therefore a multi-year capital and engineering programme, not a software update. The work that can start immediately is less glamorous: an asset register, network segmentation, control of remote access, compensating controls around unpatchable equipment, and a recovery plan that includes spare hardware. Those five moves map directly onto the strategy's language.

Five moves for the next two quarters

1. Build a consequence-ranked asset register

Start with the twenty assets whose failure would stop the highest-consequence process, not with every device on the network. For each, record the model, firmware or program revision, network reachability, safety role, end-of-life status, single-source dependencies and the spare modules held on site. Condition-monitoring data is part of the picture: a Bently Nevada 3500/22M TDI module and 3500/42 proximity and seismic monitors tell you whether an anomaly is mechanical or digital, which shortens the triage path when something looks wrong.

2. Segment by consequence, not by department

Most flat networks exist because a project needed a connection and a switch was available. Consequence-based segmentation starts with the cells that matter most and puts a controlled boundary around them. A Stratix 5700 managed switch or a Siemens 6GK5208 managed switch gives port-level visibility and VLAN control; a SCALANCE S602 firewall module can enforce a boundary at the cell instead of relying on a single perimeter appliance. Where EtherNet/IP devices need to cross a zone, a 1756-EN2TR bridge or the conformally coated 1756-EN2TXT keeps the link documented and replaceable.

3. Make remote access a controlled path

Remote access is where policy usually diverges from practice. Inventory every vendor account, cellular router, modem and VPN profile. Remove what is no longer used, put the rest behind a jump host with multi-factor authentication and time-bound approval, and log the session. If an OEM needs access for a warranty repair, give it a named account and a window, not a permanent tunnel. This is the cheapest high-impact control in the strategy's Defend pillar.

4. Compensate where you cannot patch

Where a controller or HMI cannot be patched, reduce what an attacker can reach. Disable unused services and ports, restrict USB use, apply application allowlisting on HMIs, and put virtual patching or ACLs in front of the asset. Keep a current image of each HMI so a compromised terminal can be rebuilt rather than forensically cleaned. A PanelView Plus 1000 terminal is a practical example of an asset where configuration control and a spare unit matter more than an antivirus product.

5. Treat spares and recovery as security controls

Availability is part of resilience, and resilience is the third pillar. A known-good spare CPU, I/O module, communication card or power supply is what turns a disruptive event into a maintenance task. Keep critical spares at known firmware revisions, test them before they are needed, and store the matching program and configuration files with them. A 1606-XLS480E power supply or a Bently 3500/15 power module is unglamorous until the alternative is a stopped line.

The legacy PLC problem: you cannot patch a PLC-5

The strategy's OT objective is easier to state than to execute on a plant with a 25-year-old control platform. A PLC-5/60 controller or an SLC 5/04 processor was designed for deterministic control, not for TLS, user accounts or audit logs. Firmware updates are rare or unavailable, and the engineering tools that support them often run on older operating systems. A Series 90-30 Ethernet interface or an S7-400H CPU can be equally exposed once it is connected to a wider network for data collection.

There are only three honest options: replace, isolate or compensate. Most plants end up doing all three in different areas. Replacement is the cleanest answer where capital and downtime allow. Isolation is usually the fastest. Compensating controls bridge the gap in between. What does not work is pretending that a legacy platform is secure because it is old, obscure or physically inconvenient to reach.

Spare parts sit on the availability side of that equation, not the security side. A spare 1747-AENTR communication module or 1769-AENTR adapter will not stop an intrusion, but it can restore production after hardware failure or a destructive recovery. The security value comes from knowing the part is genuine, the firmware matches, and the replacement can be commissioned from a documented backup.

What "OT supply-chain integrity" means for buyers

CISA uses the phrase "assure OT supply chain integrity" in the Defend pillar, and pairs it with software supply-chain transparency. For a maintenance or procurement team, that has a concrete meaning: provenance, revision control and test evidence.

Ask for the part number, firmware or hardware revision, date code and test record. For safety-critical or high-consequence assets, prefer a traceable source over an anonymous marketplace listing. Counterfeit or misrepresented industrial modules are a real supply-chain risk, and a part of unknown provenance is a poor foundation for a recovery plan. This is not a new CISA mandate for private buyers, but it is the direction in which procurement questions are moving. The same logic applies to software: if you cannot identify the version running on an HMI or network device, you cannot assess its exposure.

Reputable surplus and refurbished supply has a role here, especially for discontinued platforms. The condition is documentation. A tested module with a known revision and a warranty is a different product from an untested pull of unknown history, even when the label looks the same.

A 90-day plan that mirrors CISA's cadence

CISA gave itself 60, 180 and 365 days. A plant can use the same rhythm without waiting for guidance.

What to watch next

The strategy is a direction, not a finished rulebook. Four things are worth tracking over the next year:

• Late December 2026: CISA's 60-day programmatic review of core services and capabilities. It should show which programmes are being expanded or cut.
• Late April 2027: the 180-day implementation and measurement plan. This is where consequence-based prioritisation becomes visible in metrics.
• Late October 2027: the 365-day progress report, which will be the first public scorecard against the strategy.
• Sector guidance and procurement signals: the National Risk Register, further OT isolation guidance and software bill-of-materials work. CISA's July 2026 OT isolation guidance and September 2026 detection guidance show the direction of travel.

Bottom line: CISA 2030 is a prioritisation document, not a mandate. The operators who benefit are those who can show, in writing, which assets matter most, how they are isolated, and how quickly they can recover. Spare parts are part of that evidence, not a separate purchasing category.

Frequently asked questions

What is CISA 2030: Defend, Harden, Prevail?

It is CISA's strategy released on 26 October 2026. It is built on three pillars: Defend (lead national cyber defense), Harden (prioritise national infrastructure security) and Prevail (mobilise national resilience). It commits the agency to intelligence-driven, consequence-based prioritisation instead of all-hazards coverage.

Does CISA 2030 create new legal obligations for private companies?

No. It is an internal strategy for how CISA will focus its resources, partnerships and programmes. It does not itself impose new rules on private operators. Its practical effect will be felt through guidance, incident-response priorities, assessment criteria, grant conditions and procurement expectations that follow from the strategy.

Why does CISA 2030 matter to OT and ICS operators?

Because OT is a named objective, not an afterthought. CISA commits to helping owners modernise OT environments, improve asset visibility and anomaly detection, and assure OT supply-chain integrity. Those are the same capabilities that determine how quickly a plant can detect, isolate and recover from an intrusion.

What does consequence-based prioritisation mean in practice?

It means ranking assets by what happens if they stop: how many people are affected, how long service is lost, and what recovery requires. CISA says it will deprioritise threat-agnostic, all-hazards approaches. For a plant, that translates into a short list of high-consequence processes, the systems they depend on, and the spares and procedures needed to restore them.

Can legacy PLCs be secured without replacement?

Not to the same standard as modern controllers, but they can be defended. The usual mix is isolation behind a firewall, removal of unnecessary remote access, network monitoring, application allowlisting on HMIs, and tested backups. Replacement is the cleanest answer where budget and downtime allow; compensating controls bridge the gap where they do not.

How should spare-parts planning change?

Treat spares as part of recovery, not just maintenance. Identify single-source and end-of-life modules on high-consequence assets, keep known-good units at known firmware revisions, test them, and record provenance. CISA's OT supply-chain objective makes traceability a procurement question, not only a price question.

Sources

• Cybersecurity and Infrastructure Security Agency, CISA 2030: Defend, Harden, Prevail, strategy document, 26 October 2026.
• CISA press release, "CISA Unveils New Strategy to Strengthen National Cyber Defense and Critical Infrastructure Security", 26 October 2026, including remarks by Acting Director Nick Andersen.
• CISA, CISA 2030 programme page and strategy download, cisa.gov, accessed 28 October 2026.
• The White House, Cyber Strategy for America, March 2026, and National Resilience Strategy, June 2026, as referenced by CISA 2030; Executive Order 14239 as cited in the strategy.
• CISA, "CISA Joins Australia and Others to Publish Guidance to Isolate Operational Technology and Enabling Systems in Critical Infrastructure", 28 July 2026.
• CISA, "New CISA Guidance Helps Critical Infrastructure Detect, Observe and Impede Malicious Cyber Activity", 16 September 2026.
• CISA and partners, updated Software Bill of Materials resource, 29 July 2026.
• Infosecurity Magazine, "CISA 2030 Sets Out 'Aggressive, Anticipatory' Cyber Defense Strategy for Critical Infrastructure", 26 October 2026, for contemporaneous coverage and framing.
• Autodcstech product catalogue pages for the controllers, I/O, HMIs, network and condition-monitoring modules linked above, current October 2026.

Talk to us

If you are mapping a legacy control platform to a consequence-based plan and need help identifying the CPU, I/O, communication, HMI, power-supply or network modules that keep it running, send your nameplate details to our enquiry desk. The relevant ranges are PLC and I/O modules, communication modules, industrial Ethernet switches, network adapters and HMIs and operator panels. More background is in the guides library, and this article is part of industry news.