The United States replaced its 2023 national cybersecurity strategy on 6 March 2026 with "President Trump's Cyber Strategy for America", and private sector security teams need to know which parts change their obligations and which are statements of intent. The strategy is short, organised around six pillars, and was released alongside an Executive Order on cybercrime and fraud. It is a policy document, not law: it creates no new duties by itself, and most of its effects will arrive through later executive orders, agency rules, procurement terms and legislation. This guide summarises each pillar, the companion order, what has and has not happened since, and practical steps for CISOs, critical infrastructure operators, federal suppliers and legal teams. Status is as of November 2026.
Source note: the six pillars are from the White House strategy text; release date and context are from the Congressional Research Service; the Executive Order and CISA 2015 status are from Crowell & Moring, Federal News Network and Nextgov reporting. Confirm against the official text before relying on it.
Key takeaways
- Six pillars, one theme. Shape adversary behaviour, promote common sense regulation, modernise federal networks, secure critical infrastructure, sustain technology superiority, and build talent; the tone shifts from regulation towards deterrence and deregulation.
- Policy, not law. The strategy imposes no obligations itself; watch for executive orders, agency rulemaking and contract clauses, which the National Cyber Director said in April 2026 were expected.
- Companion Executive Order on cybercrime. "Combating Cybercrime, Fraud, and Predatory Schemes Against American Citizens" targets transnational scam operations and asks the Attorney General to recommend a Victims Restoration Program.
- Private sector as active participant. The strategy proposes incentives for private firms to find and disrupt adversary networks, which revives the "hack back" debate; no safe harbours have been defined, so existing computer misuse law still applies.
- Information sharing is the near-term risk. The Cybersecurity Information Sharing Act of 2015 has been running on short extensions; a stopgap carried it into early December 2026, so check its status before relying on its liability protections.
What the strategy is and where it came from
The document, titled "President Trump's Cyber Strategy for America" and marked March 2026, was released by the White House on 6 March 2026. It replaces the National Cybersecurity Strategy of March 2023. The Congressional Research Service noted that the 2023 strategy emphasised collaboration with the private sector to build more secure products, while the new one suggests companies will engage malicious actors more directly. The National Cyber Director, Sean Cairncross, said the strategy would be followed by an action plan; in April 2026 he said implementation was "rolling forward actively" and that more executive orders were likely. As of November 2026 we could not confirm publication of a full implementation plan, so treat implementation detail as pending.
| Item | 2023 National Cybersecurity Strategy | 2026 Cyber Strategy for America |
|---|---|---|
| Organising structure | Five pillars | Six pillars of action |
| Regulatory direction | Expanded minimum requirements for critical infrastructure; software liability debate | "Common sense regulation": streamline rules, reduce compliance burden, address liability, align regulators |
| Private sector role | Collaboration on defence and secure products | Incentives for private firms to find and disrupt adversary networks |
| Offensive posture | Disruption campaigns led by government | Full suite of defensive and offensive cyber operations; raise costs of aggression |
| Emerging technology | Post-quantum, clean energy, digital identity | Post-quantum, AI stack security, agentic AI for defence, cryptocurrency and blockchain security |
The 2023 column is from general knowledge of that strategy; the 2026 column is from the strategy text.
The six pillars
| Pillar | Main lines of effort (from the strategy) | What it may mean for private sector teams |
|---|---|---|
| 1. Shape Adversary Behavior | Deploy the full suite of defensive and offensive cyber operations; incentivise the private sector to find and disrupt adversary networks; dismantle criminal infrastructure and cut off financial exits and safe havens; counter surveillance and authoritarian technologies | More government requests for telemetry and indicators; possible frameworks for private disruption activity; more takedown operations |
| 2. Promote Common Sense Regulation | Streamline cyber and data regulation; reduce compliance burden; address liability; align regulators and industry globally; emphasise privacy of American data | Possible harmonisation of overlapping reporting and control requirements; some rules may be revised or replaced |
| 3. Modernize and Secure Federal Government Networks | Best practices, post-quantum cryptography, zero-trust architecture and cloud transition; elevate cyber in leadership and boardrooms; continuous testing and hunting; prioritise National Security Systems; adopt AI-powered security tools and more competitive procurement | Federal suppliers should expect contract requirements around zero trust, PQC readiness and AI-enabled tooling |
| 4. Secure Critical Infrastructure | Identify, prioritise and harden energy, finance, telecoms, data centres, water and hospitals; secure IT and OT supply chains and move away from adversary vendors; deny initial access and speed recovery; supporting role for state, local, tribal and territorial authorities | Vendor vetting and possible restrictions on foreign technology; renewed focus on initial access controls and recovery |
| 5. Sustain Superiority in Critical and Emerging Technologies | Privacy-protecting technology by design; post-quantum cryptography; secure the AI stack including data centres; AI-enabled tools to detect, divert and deceive attackers, including agentic AI for defence; counter foreign AI platforms that censor, surveil or mislead | Expect guidance on AI security and agentic AI in defence; PQC migration expectations |
| 6. Build Talent and Capacity | Talent pipeline across academia, vocational schools, industry and venture capital; train the current workforce; remove barriers between industry, academia, government and military | Possible public-private rotation and training programmes |
The strategy text does not mention CISA, NIST, memory-safe languages or identity by name. Commentators should not read specific control requirements into it that it does not contain.
The companion Executive Order on cybercrime and fraud
The Executive Order "Combating Cybercrime, Fraud, and Predatory Schemes Against American Citizens", released with the strategy, is the most concrete near-term instrument. According to legal analysis of the order:
- Action plan: senior officials must review existing frameworks against transnational criminal organisation cybercrime and submit an action plan that identifies organisations running scam centres and creates an operational cell within the National Coordination Center.
- Commercial intelligence: agencies are directed to use threat intelligence and capabilities from commercial cybersecurity firms to track and disrupt actors.
- Victims Restoration Program: the Attorney General must recommend a programme funded by assets seized or forfeited from these organisations. Eligibility and process were not defined at release.
- Diplomatic pressure: the Secretary of State must press foreign governments, with possible limits on assistance, sanctions and trade penalties for states that tolerate cybercrime.
For security teams the practical effect is that fast reporting to law enforcement may matter more, because recovery of funds depends on early engagement. Business email compromise and investment scams are squarely in scope; see the Email Identity and BEC Guide and the Cybercrime Law Enforcement Takedowns Guide.
What changes for private sector security teams
Regulation and reporting
Pillar 2 signals streamlining, not removal of all rules. Existing obligations remain until formally changed: SEC cyber incident disclosure for listed companies, sector rules, state laws, and the pending CIRCIA final rule. Legal commentators expect the landscape to become more fragmented in the short term, with state and local rules described as a complement to federal effort. Keep a regulatory register and track changes rather than pausing compliance work. See the CIRCIA Incident Reporting Guide.
Information sharing
The liability protections for sharing cyber threat indicators under the Cybersecurity Information Sharing Act of 2015 depend on the Act remaining in force. It has been extended several times by short-term measures; a continuing resolution in autumn 2026 extended it into early December 2026, and long-term reauthorisation had not been enacted as of November 2026, when industry groups were still urging Congress to renew it (Nextgov, November 2026). Before sharing indicators with government under that Act, confirm with counsel that it is in force. See the Cybersecurity Information Sharing Act of 2015 Guide and the ISACs and Information Sharing Communities Guide.
Private disruption activity
The strategy's language on incentivising private firms to disrupt adversary networks has not been turned into any authorisation. Accessing systems you do not own without authorisation remains a potential offence under the Computer Fraud and Abuse Act. Do not change incident response playbooks to include offensive action unless and until there is a defined legal framework and counsel has approved it. See the Computer Misuse and Anti-Hacking Laws Guide.
Critical infrastructure and supply chain
Operators in energy, finance, telecoms, data centres, water and health should expect vendor vetting and possible restrictions on adversary-linked products. The strategy's focus on denying initial access matches what recent intrusions show: state actors prepositioning on infrastructure, as described in the Volt Typhoon Threat Actor Profile, and telecom compromise through stolen credentials and unpatched devices in the Salt Typhoon telecom intrusions.
Where identity fits
The strategy does not name identity, but the pillars it prioritises depend on it. Zero-trust architecture (Pillar 3) is an identity-centric model; denying initial access (Pillar 4) is largely about credentials, MFA and remote access accounts, as the Colonial Pipeline attack showed with one unused VPN account; and agentic AI for defence (Pillar 5) creates new machine identities that need owners, scoped permissions and audit. See the CISA and NSA Identity and Access Management Recommended Best Practices Guide.
Timeline and status tracker
| Date | Event | Status as of November 2026 |
|---|---|---|
| 6 March 2026 | Strategy and Executive Order "Combating Cybercrime, Fraud, and Predatory Schemes Against American Citizens" released | Published; policy direction only |
| 11 March 2026 | Congressional Research Service Insight IN12667 notes the action plan was not released with the strategy | Implementation plan pending at that date |
| 15 April 2026 | National Cyber Director says more executive orders are likely and plans will come "relatively soon" | We could not confirm a full published implementation plan by November 2026 |
| 30 September 2026 | Scheduled expiry of the Cybersecurity Information Sharing Act of 2015 under an earlier extension | Extended by continuing resolution into early December 2026; long-term reauthorisation not passed |
| Pending | Victims Restoration Program recommendation from the Attorney General | Details not published in the sources we reviewed |
Recheck each row before relying on it. Federal cyber policy in 2026 has moved through executive orders and appropriations riders rather than standalone statutes, so dates shift with funding deadlines.
Questions to ask your legal and policy teams
- Which of our current obligations are federal regulations that Pillar 2 could change, and which are state laws, contracts or sector rules that will not move with federal policy?
- Do we share indicators under the 2015 Act, and what is our fallback if its protections lapse?
- Are any of our products, components or suppliers linked to the adversary vendors the strategy wants removed from critical infrastructure supply chains?
- What is our position if a government agency asks us to support a disruption campaign or share telemetry beyond what we share today?
- How quickly can we report fraud to law enforcement, and who is authorised to do it out of hours?
Decision guidance by organisation type
| Organisation | Priority now | Watch for |
|---|---|---|
| Federal contractor or cloud provider | Zero trust maturity, PQC inventory, FedRAMP posture | New contract clauses and procurement changes under Pillar 3 |
| Critical infrastructure operator | Initial access controls, OT supply chain review, recovery testing | Sector rules, vendor restrictions, CIRCIA final rule |
| Listed company | Board reporting on cyber risk; incident disclosure process | Any changes to SEC disclosure rules under Pillar 2 |
| Small or mid-sized business | BEC and fraud controls, fast reporting route to law enforcement | Victims Restoration Program details |
| AI developer or user of agentic AI | AI stack security, agent identity governance | AI security guidance flowing from Pillar 5 |
How to respond: a phased plan
- Brief leadership (first month). Explain that the strategy is direction, not regulation, and list the instruments to watch: executive orders, agency rules, contract terms, CISA 2015 reauthorisation.
- Map your obligations. Build or refresh a register of current cyber obligations with owner and status, so that harmonisation changes can be assessed against something concrete.
- Close initial access gaps. Phishing-resistant MFA on remote access and admin accounts, removal of dormant accounts, patching of internet-facing edge devices using the CISA KEV Catalogue Guide for prioritisation.
- Start PQC and zero trust work. Inventory cryptography and plan migration; see the Post-Quantum Cryptography Migration Guide.
- Prepare law enforcement engagement. Pre-agree when and how you report fraud and intrusions to the FBI, and keep evidence handling ready.
- Review quarterly. Reassess against new executive orders and rules; adjust the plan rather than restarting it.
Measuring progress
- Obligation register currency: share of entries reviewed in the last quarter.
- Initial access exposure: number of internet-facing systems with KEV-listed vulnerabilities past due; remote access accounts without phishing-resistant MFA.
- PQC inventory coverage: share of systems with cryptographic inventory complete.
- Reporting speed: median time from detecting fraud or intrusion to law enforcement report.
- Supplier exposure: share of critical suppliers assessed for adversary-linked ownership or components.
Framework mapping
| Strategy theme | Framework reference |
|---|---|
| Tracking regulatory change (Pillar 2) | NIST CSF 2.0 GV.OC-03; ISO/IEC 27001:2022 Annex A 5.31 (legal, statutory, regulatory and contractual requirements) |
| Federal modernisation, zero trust (Pillar 3) | NIST SP 800-207; CISA Zero Trust Maturity Model; NIST SP 800-53 AC-2, IA-2 |
| Continuous testing and hunting (Pillar 3) | NIST SP 800-53 CA-8 (Penetration Testing), SI-4 (System Monitoring); NIST CSF 2.0 DE.CM-01 |
| Supply chain and adversary vendors (Pillar 4) | NIST CSF 2.0 GV.SC-01, GV.SC-07; NIST SP 800-53 SR-3 |
| Vulnerability-led initial access defence (Pillar 4) | NIST CSF 2.0 ID.RA-01; CISA KEV catalogue |
| Workforce (Pillar 6) | NICE Workforce Framework for Cybersecurity (NIST SP 800-181) |
Common failure patterns
- Treating deregulation as permission to stop. Existing rules stay in force until changed; pausing compliance creates exposure.
- Reading in requirements that are not there. Quoting the strategy as mandating specific controls it never mentions undermines credibility with boards and auditors.
- Assuming information sharing protections are permanent. CISA 2015 has lapsed before; check before sharing.
- Acting on "hack back" rhetoric. No safe harbour exists; unauthorised access to third-party systems is still a legal risk.
- Ignoring the fraud order. BEC and scam losses are the most likely way most organisations meet this policy; slow reporting reduces any chance of recovery.
Practitioner checklist
- Brief the board that the strategy is direction, not regulation, and name the instruments to watch.
- Maintain a current register of federal, state and sector cyber obligations.
- Confirm the status of CISA 2015 before relying on its protections.
- Exclude offensive actions from response playbooks unless counsel approves under a defined framework.
- Prioritise initial access controls: MFA, dormant account removal, KEV patching.
- Start or continue PQC inventory and zero trust roadmaps.
- Pre-agree a law enforcement reporting route for fraud and intrusions.
- Assess critical suppliers for adversary-linked ownership and components.
- Review new executive orders and agency rules quarterly against this plan.
Standards and references
- The White House: President Trump's Cyber Strategy for America
- Congressional Research Service: The Trump Administration's Cyber Strategy (IN12667)
- Crowell and Moring: White House's New Cyber Strategy and Executive Order
- CyberScoop: Executive orders likely ahead in next steps for national cyber strategy
- Federal News Network: CR extends cyber info sharing law through December
- CISA: Known Exploited Vulnerabilities Catalog
- NIST: SP 800-207 Zero Trust Architecture
Related NHI Mgmt Group resources: Cybersecurity Information Sharing Act of 2015 Guide · Critical Infrastructure Regulation Map · CISA Zero Trust Maturity Model Guide · Post-Quantum Cryptography Migration Guide. This guide summarises President Trump's Cyber Strategy for America and its companion Executive Order as checked on 11 November 2026 and is not legal advice.