EXECUTIVE SUMMARY Our nation is at a moment of opportunity. The 2023 U.S. National Cybersecurity Strategy outlines a new vision for cybersecurity, a vision grounded in collaboration, in innovation, and in accountability. Now is the moment where our country has a choice: to invest in a future where collaboration is a default rather than an exception; where innovation in defense and resilience dramatically outpaces that of those seeking to do us harm; and where the burden of cybersecurity is allocated toward those who are most able to bear it. We must be clear-eyed about the future we seek, one in which damaging cyber intrusions are a shocking anomaly, in which organizations are secure and resilient, in which technology products are safe and secure by design and default. This is a shared journey and a shared challenge, and CISA, as America’s cyber defense agency, is privileged to serve a foundational role in the global cybersecurity community as we achieve measurable progress to our shared end state. We know that the stakes are high. Our nation relies on connected technologies every hour of every day to enable essential services, from drinking water to electricity to financial systems. In recent years, this dependence has deepened even further, as many Americans now rely on connectivity for most aspects of their daily lives. Malicious cyber actors recognize our dependence on technology and constantly attempt to exploit this reliance for financial or strategic gain. Too often, they succeed. Their success is enabled by an environment of insecurity, in which our enterprises are too difficult to defend, and our technology products are too vulnerable to protect. But we also know the steps to take. We must change how we design and develop technology products, such that exploitable conditions are uncommon and secure controls are enabled before products reach the market. We must quickly detect adversaries, incidents, and vulnerabilities, and enable timely mitigation before harm occurs. We must help organizations, particularly those that are “target rich, resource poor,” take the fewest possible steps to drive the most security impact. Recognizing that we will not prevent every intrusion, we must ensure that our most essential services are resilient under all conditions, with particular focus on under-resourced communities where loss of key services can have the greatest impact. Most importantly, we must do it together, recognizing that true collaboration is the only path toward a more secure future. C I S A C Y B ER S EC U RI T Y ST R AT EG I C PL A N 1