Cybersecurity Awareness Month has spent most of its history talking to individuals: use a password manager, turn on multifactor authentication, think before you click. The 2026 edition, which runs October 1 through October 31, splits its message. The National Cybersecurity Alliance is running “Don’t Make It Easy for Them,” a habits-focused theme aimed at businesses and consumers. CISA, which co-leads the month, is running “Securing the Next 250,” tied to the 250th anniversary of the United States, and it points squarely at the owners and operators of critical infrastructure.
For an operator of a water system, a power utility, a hospital, or a transit agency, that split matters. The CISA theme is the one with an operational ask attached, and the ask is more specific than a poster campaign usually is.
What CISA actually announced
CISA launched the campaign on October 1, 2026. In the announcement, Acting Director Nick Andersen framed critical infrastructure and state, local, tribal, and territorial governments as CISA’s priority, and the agency addressed the campaign to organizations that own, operate, or support critical infrastructure. The statistics are thin: CISA’s page says nation-state threats are increasing but supplies no numbers, so treat the campaign as guidance, not a threat report.
The guidance comes in tiers. The foundation is the familiar four: train people to recognize and report phishing, require strong passwords, require multifactor authentication, and keep software updated. The next tier is organizational: turn on system logging, back up data on a schedule tied to recovery point objectives, encrypt data and devices, report incidents to CISA, and maintain and exercise an incident response plan at least annually. Industry coverage of the launch also notes the plan should cover ransomware scenarios and involve leadership and legal counsel.
One line in that tier deserves more attention than it will get: CISA asks organizations to prepare to run essential functions through a disruption, with paper-based operations or radio communications given as examples. That is a continuity-of-operations request, not a security-tooling request, and it is where many operators have the least rehearsed capability.
The 3Rs: Reduce, Replace, Recover
For critical-infrastructure owners and operators specifically, CISA promotes what it calls the 3Rs.
Reduce means shrinking the attack surface, linked to CISA’s guidance on prioritizing security updates by risk. Coverage of that guidance, BOD 26-04 (issued June 2026), describes a shift away from severity-only triage toward four questions: is the asset publicly exposed, is the flaw known to be exploited, can an adversary exploit it automatically, and does exploitation give partial or total control. The directive binds federal civilian agencies, not private operators, but CISA’s leadership has encouraged other organizations to adopt similar practices.
Replace means retiring devices that no longer receive security updates, linked to BOD 26-02, “Mitigating Risk From End-of-Support Edge Devices,” issued February 2026. Secondary coverage describes its scope as devices at the network boundary, such as firewalls, routers, load balancers, and VPN gateways, with an 18-month window for federal agencies to replace identified end-of-support devices. Again, the directive itself applies only to federal civilian agencies; CISA encourages all network defenders to follow the companion guidance.
Recover means restoring operations quickly, supported by CISA’s CI Fortify resources. CISA’s launch page gives these three items only short labels and links onward, so the detail lives in the linked guidance, not the announcement.
Turning the theme into an operator’s checklist
A campaign month is a useful forcing function only if it ends with decisions. A practical way to use October:
Reduce: start with what faces the internet
Build or refresh an inventory of externally reachable assets, including remote-access gateways and management interfaces for operational technology. Then apply the four-question screen above to your open vulnerabilities rather than sorting by CVSS alone. An internet-facing gateway with a known-exploited flaw outranks a higher-scored bug on an isolated segment.
Replace: find the unsupported boundary devices
Most asset lists record when a device was bought, not when its vendor stops patching it. Add the end-of-support date as a field, sort by it, and put every boundary device within a year of that date on a replacement schedule with a budget line. In operational environments the difficulty is rarely identifying the device; it is getting an outage window, which is why the planning has to start before the date, not on it.
Recover: rehearse the manual fallback
Run one tabletop where the scenario is not “the data is encrypted” but “the control network is untrusted and we operate by hand for several days.” Ask who authorizes the switch to manual operation, how operators communicate if the corporate network is down, and whether backups are recoverable to a known-clean state on the timeline your recovery point objective implies. CISA’s guidance to exercise the plan at least annually sets a floor, not a target.
Where the two themes meet
The Alliance’s habit-focused theme and CISA’s operator-focused one are less separate than they look. The foundational four actions appear in both, and for a utility the human layer is still the entry point: phishing-resistant authentication on remote access and administrative accounts is the control most often missing between a stolen credential and an operational incident. The operator-specific 3Rs sit on top of that floor; they do not replace it.
The measure of a month like this is not how many staff watched a training video. It is whether, by November 1, the organization can answer three questions it could not on September 30: which boundary devices are out of support, which of its internet-facing flaws are actually being exploited, and how it would run the plant if the network went dark. If the answers exist, the theme did its job.
Sources for this piece include CISA’s Cybersecurity Awareness Month announcement and campaign page, NCA’s campaign page, and industry-press coverage of BOD 26-02 and BOD 26-04. Directive details are drawn from secondary coverage; consult CISA’s announcement and the directive texts for exact requirements and deadlines.