CISA Cyber Security Awareness Campaign

CISA’s mission is to lead the national effort to understand, manage, and reduce risk to our cyber and physical infrastructure. In carrying out this mission, Section 2202 of the Homeland Security Act of 2002 assigns CISA with the responsibilities to coordinate a national effort to secure and protect against critical infrastructure risks, carry out cybersecurity and critical infrastructure stakeholder outreach and engagement, and encourage and build cybersecurity awareness and competency across the United States. In carrying out its mission and pursuant to these authorities, CISA provides financial assistance under the CAC Program to non-federal entities to perform cybersecurity awareness activities to reduce cybersecurity risks through messaging, tools, and resources to encourage individuals and organizations to reduce their exposure to malicious cyber activity. Through strategies implemented year-round with a focal point of the Cybersecurity Awareness Month in October, a recipient under this federal award engaged in efforts to improve the public’s understanding of cyber threats, amplify opportunities that individuals and non-federal entities can leverage to strengthen their own cybersecurity posture, and encourage discussion, engagement, and actions that can be taken to reduce cyber risk. For the CAC program, CISA established the following six goals: 1. Strengthen the security and resilience of critical infrastructure; 2. Assess and counter evolving cybersecurity risks through actions that promote threat risk reduction; 3. Build a national culture of preparedness for all Americans, ensuring equity and accessibility in our efforts to increase online and digital safety; 4. Build stakeholder relationships that encourage and support data-driven actions by governments, the private sector, tribes, non-profits, and the public that reduce cybersecurity risk; 5. Reinforce the importance of secure by default and secure by design industry practices that do not place the first line of cyber threat risk reduction on those with the least capabilities and resources; and 6. Encourage activities supported by data which result in key behavior change that reduce cyber risk. CISA established the following six objectives for the CAC Program: 1. Educate the public, small businesses, and industry about the dangers of cyber threats and key actions that can be taken to mitigate risks; 2. Promote sustainable cybersecurity and encourage the technology industry to provide secure-by-default technology products with strong security features right out of the box, without added costs; and technology that is secure-by-design, purposefully developed, built, and tested to significantly reduce the number of exploitable flaws before they are introduced into the market for broad use; 3. Identify effective approaches to increase cybersecurity awareness among the general public and target audiences, including vulnerable populations and those with disabilities that may make it challenging to take actions that reduce risk; 4. Build relationships and coalitions across cybersecurity stakeholders to support Cybersecurity Awareness Month; 5. Develop a baseline from which to measure the impact Cybersecurity Awareness Month campaign strategies and messaging has on changing behavior and increasing public awareness of cybersecurity risk; and 6. Contribute to the agency’s efforts to build a culture of preparedness, by informing and empowering communities and individuals to obtain the skills and take the preparatory actions necessary to become more resilient against threats and hazards Americans face.