CISA Launches Cybersecurity Awareness Month: Securing the Next 250

CISA Launches Cybersecurity Awareness Month: Securing the Next 250 WASHINGTON – The Cybersecurity and Infrastructure Security Agency (CISA) kicks off Cybersecurity Awareness Month today. CISA updated our Cybersecurity Awareness Month page with additional information, tips, and resources, including for business and government organizations—if you haven’t done so yet, be sure to check out this year’s toolkit. This year’s theme is Securing the Next 250, highlighting the need for everyone to play their part in strengthening the country's infrastructure against cyber threats. At a time when nation-state backed cyber threats continue to increase and super intelligence is transforming both threats and security, it is more important than ever that those that own and operate the nation’s critical infrastructure take steps to protect it. “Whenever critical infrastructure is disrupted, so are the businesses and communities that depend on vital services,” said Acting CISA Director Nick Andersen. “That’s why CISA is prioritizing the security and resilience of critical infrastructure, and state, local, tribal, and territorial government (SLTT), whose systems and services sustain us every day. This includes things like clean water, secure transportation, quality healthcare, secure financial transactions, rapid communications, and more. However great or small—every organization that touches critical infrastructure is vital to ensuring uninterrupted services to America’s communities.” Business and government organizations that own, operate, or support critical infrastructure should take core actions to help secure the systems and services that make America a great place to live and do business. The following four practices are foundational and should be as automatic as buckling a seatbelt: - Teach employees to avoid phishing scams. Recognizing and reporting suspicious emails and links may prevent cyber intrusions. - Require strong passwords. Long, random, unique passwords make accounts harder to breach. - Require multifactor authentication. Adds an extra layer of protection if a password is compromised. - Update software. Keeps systems protected against known vulnerabilities. Take the Next Steps to Level Up Your Defenses - Use logging on your systems: Log activity so your team can monitor signs that threat actors may be trying to access your systems. Learn how to monitor key information to protect your business. - Back up data: Incidents happen, but when you back up critical information, recovery is faster and less stressful. Put a backup plan in place that aligns with your organization’s recovery point objective to protect your systems and keep things running smoothly. - Encrypt data: Encrypting your data and devices strengthens your defense against attacks. Even if criminals gain access to your files, information stays locked and unreadable. Make encryption part of your security strategy - Get a .gov domain: Government entities, including SLTT governments, can get a .gov domain for additional security – check out get.gov for more information. - Report cyber incidents to CISA at cisa.gov/report - Have an incident response plan and use it: Organizations should develop, maintain, update, and regularly exercise IR plans for common threat scenarios such as ransomware attacks. Ensure drills are realistic and include all relevant stakeholders, such as organizational leadership and legal counsel, in addition to technical personnel. IR plans should be reviewed and drilled on an annual basis at a minimum. - Be prepared for system disruptions: Organizations should develop and execute plans to recover and restore service to critical assets or systems that might be impacted by a cybersecurity incident. Consider including the ability to execute mission essential functions without access to critical assets or even internet access (e.g., shift to paper-based operations, radio communications, etc.) And for those who own or operate critical infrastructure, we invite you to join us in practicing the 3Rs of Cybersecurity: Reduce, Replace, Recover: As Cybersecurity Awareness Month 2026 begins, let’s remember that safeguarding our nation’s critical infrastructure is a shared responsibility. Whether you’re a business leader, government official, or an employee on the front lines, your actions matter. By embracing foundational cybersecurity practices and preparing for the unexpected, we can build a more resilient America—one where essential services remain secure and communities thrive. Together, let’s secure the next 250 and beyond. ### About CISA As the nation’s cyber defense agency and national coordinator for critical infrastructure security, the Cybersecurity and Infrastructure Security Agency leads the national effort to manage, uncover, and reduce risk to our digital and physical infrastructure Americans rely on every hour of every day. Visit CISA.gov for more information and follow us on X, Facebook, LinkedIn, Instagram.