Shields Ready
As the National Coordinator for critical infrastructure security and resilience, CISA stands ready to help America prepare for and adapt to changing risk conditions and withstand and recover rapidly from potential disruptions, regardless of cause.
Overview
CISA’s Shields Ready campaign is about making resilience during incidents a reality by taking action before incidents occur. As a companion to CISA’s Shields Up initiative, Shields Ready drives action at the intersection of critical infrastructure resilience and national preparedness. This campaign is designed to help all critical infrastructure stakeholders to take action to enhance security and resilience—from industry and businesses to government entities at all levels, and even individuals by providing recommendations, products, and resources to increase individual and collective resilience for different risk contexts and conditions.
By taking steps in advance of an incident, organizations, individuals, and communities are better positioned to quickly adjust their posture for heightened risk conditions, in turn helping to prevent incidents, to reduce impact, and get things back to normal—or better—as quickly as possible. Being part of the resilience journey makes for more resilient people, organizations, and communities.
Current Threat Landscape
Today’s challenges are dynamic and rapidly evolving as technology advances. State-sponsored cyber threats from nation-state cyber actors like Iran, North Korea, People's Republic of China, and Russia, the mounting risks of severe weather, and the uncertainties of artificial intelligence demand unwavering vigilance and adaptability.
A shifting geopolitical landscape has intensified national security concerns and has shown how targeting critical infrastructure can be a primary attack vector for weakening a country’s ability to protect itself, and its citizens. This can occur both in a conflict setting, as well as through indirect, long-term foreign interference campaigns.
Additionally, the interconnectivity of critical infrastructure also creates risks because a disruption in one place can ripple near and far. We can and must be more resilient to the range of changing risk conditions that threaten critical infrastructure and the communities, and nation, it supports.
Complicating matters, the boundaries between the nation’s cyber and physical infrastructure are increasingly blurred. The convergence of cyber-physical technologies and systems that deliver our critical functions — from manufacturing to healthcare to transportation and beyond — means that single events can manifest in the loss or degradation of service across multiple industries.
All of these factors demand a greater focus on resilience.
National Security Memorandum
On April 30, 2024, the White House published the National Security Memorandum (NSM) on Critical Infrastructure Security and Resilience. The NSM highlights CISA’s role as National Coordinator for Critical Infrastructure Security and Resilience.
Key Steps to Building Resilience
Resilience is the ability to prepare for and adapt to changing risk conditions and withstand or recover rapidly from disruptions, regardless of cause. Critical infrastructure entities and other organizations can be more resilient (or Resolve to be Resilient) by integrating certain practices that will make themselves secure, resilient, and able to bounce back quickly and build back stronger from an incident:
1: Identify Critical Assets and Map Dependencies
Determine the systems that are critical for ongoing business operations and map out their key dependencies on technology, vendors, and supply chains.
Cyber Resilience Review (CRR)
Secure Tomorrow Series Toolkit
2: Assess Risks
Consider the full range of threats that could disrupt these critical systems and the specific impacts such threats could pose to continuity of operations.
Regional Resiliency Assessment Program
3: Plan and Exercise
Develop incident response and recovery plans to reduce the impact of these threats to critical systems and conduct regular exercises under realistic conditions to ensure the ability to rapidly restore operations with minimal downtime.
Infrastructure Resilience Planning Framework (IRPF)
Infrastructure Resilience Planning Framework (IRPF) Playbook
CISA Tabletop Exercise Packages
4: Adapt and Improve
Periodically evaluate and update response and recovery plans based on the results of exercises real-world incidents and an ongoing assessment of the threat environment.
Cyber Essentials Toolkits
Additional Resources
Take advantage of the free resources available to strengthen and improve the resilience of critical infrastructure systems and services.
Critical Infrastructure Security and Resilience Month Toolkit
Discover how to get involved in Critical Infrastructure Security and Resilience Month using the one-stop-shop toolkit of CISA resources.
Planning Considerations for Cyber Incidents
This guide, produced by FEMA and CISA, is intended to help state, local, tribal, and territorial emergency management personnel collaboratively prepare for cyber events.
Resource Guide for Developing a Resilient Supply Chain Risk Management Plan
A guide to help Small and Medium-Sized Businesses establish an actionable Supply Chain Risk Management (SCRM) plan that will support the mitigation of risks and disruptions to their supply chains.
Communications and Cyber Resiliency Toolkit
The toolkit assists public safety agencies and others responsible for communications networks in evaluating current resiliency capabilities, identifying ways to improve resiliency, and developing plans for mitigating the impact of potential threats.
Secure Tomorrow Series
The Secure Tomorrow Series is a strategic foresight capability focused on identifying emerging and evolving risks that could significantly affect the nation’s critical infrastructure in the next 3 to 20 years in order to analyze, prioritize, and mana
People's Republic of China Cyber Threat
CISA works to ensure U.S. critical infrastructure, government partners, and others have the information and guidance to defend themselves against Chinese State-Sponsored cybersecurity risks.
Voluntary Cyber Incident Reporting Resource
This resource is designed to help entities that may be considering voluntarily reporting cyber incidents understand “who” CISA recommends report an incident, “why and when” CISA recommends they report, as well as “what and how to report.”
FEMA's Ready Campaign
Shields Ready partners with Ready, FEMA’s national public service campaigned designed to educate and empower people to prepare to prepare for, respond to and mitigate emergencies and disasters.