Acting CISA director urges critical infrastructure operators to 'Build a Cyber Strong America' for Cybersecurity Awareness Month

Madhu Gottumukkala, acting director of the Cybersecurity and Infrastructure Security Agency (CISA), urged organizations that own, operate, supply or support the nation’s critical infrastructure to adopt basic cybersecurity practices and to "level up" defenses as part of Cybersecurity Awareness Month.

Gottumukkala said October marks more than 20 years of Cybersecurity Awareness Month and introduced this year’s theme, "Building a Cyber Strong America," calling it "a call to action for those involved in our nation’s critical infrastructure to take simple, effective steps to secure the services and systems that keep the nation’s communities and economy secure and thriving." She said the goal is for organizations to make cybersecurity a priority.

Gottumukkala listed concrete, foundational measures she said organizations should adopt immediately: teach employees to avoid phishing; require strong passwords; require multifactor authentication; and update business software. "CISA sees breaches because people too often skip these basic steps," she said, linking lapses in those controls to observed incidents.

She also urged organizations to "level up" with additional practices including enabling system logging, backing up data, encrypting data, obtaining a .gov domain if eligible, and sharing cyber-incident information with CISA. She said these steps help protect systems and services that contribute to national security, economic activity and daily life.

Gottumukkala warned that threat actors are growing more sophisticated but said even basic protections materially reduce risk. The statement concluded with an appeal to collective responsibility: "We must all work together to build a Cyber Strong America." The prepared remarks ended with "Thank you."