CISA

CISA
Name	Cybersecurity and Infrastructure Security Agency
Formed	2018
Preceding1	National Protection and Programs Directorate
Headquarters	Washington, D.C.
Chief1 position	Director
Parent agency	Department of Homeland Security

CISA

The Cybersecurity and Infrastructure Security Agency is a federal agency created to protect critical infrastructure and digital networks. It was established to centralize responsibilities for cybersecurity, resilience, and risk reduction among federal entities and to coordinate with state, local, tribal, and private sector partners. The agency operates within the Department of Homeland Security and engages with a broad set of stakeholders including technology firms, utilities, law enforcement, and international organizations.

History

The agency traces its roots to the National Protection and Programs Directorate, which itself consolidated functions from the Transportation Security Administration, Federal Emergency Management Agency, and other post-September 11 attacks reorganizations. In response to growing concern after incidents such as the 2015 Ukraine power grid cyberattack and the 2016 U.S. election interference, Congress passed legislation to elevate the directorate into an operational component. The enabling statute was part of reforms following hearings in the United States Congress and proposals from administrations including the Barack Obama and Donald Trump administrations. The agency's creation paralleled global moves by entities like United Kingdom National Cyber Security Centre and European Union Agency for Cybersecurity to centralize cyber defense.

Mission and Responsibilities

The agency's statutory mission includes defending civilian federal networks, securing critical infrastructure sectors such as energy sector and financial sector, and reducing systemic risk from cyber incidents. It issues guidance referenced by organizations such as Microsoft, Amazon Web Services, Google, and Cisco Systems, and collaborates with standards bodies like National Institute of Standards and Technology and Internet Engineering Task Force. Responsibilities extend to incident response coordination involving stakeholders such as Federal Bureau of Investigation, National Security Agency, State and Local Cybersecurity Grant Program recipients, and international partners including NATO and the Five Eyes intelligence alliance. The agency also administers voluntary programs used by ExxonMobil, JP Morgan Chase, and AT&T to benchmark resilience.

Organizational Structure

Organizationally, the agency is led by a Director who reports to the Secretary of Homeland Security and works alongside deputies overseeing operations, strategy, and policy. Functional components include a Reactive Operations division akin to Computer Emergency Response Teams in organizations such as CERT Coordination Center and a National Risk Management Center similar in remit to units in the Australian Cyber Security Centre. Regional offices liaise with State of California, New York State, and other jurisdictions, while specialized teams engage with sectors like healthcare sector partners (e.g., Mayo Clinic, Centers for Medicare & Medicaid Services) and transportation sector entities such as Federal Aviation Administration and Amtrak. Advisory boards draw experts from institutions including Massachusetts Institute of Technology, Stanford University, Carnegie Mellon University, and industry groups like Information Technology Industry Council.

Programs and Initiatives

Key initiatives include a Continuous Diagnostics and Mitigation program adopted by agencies like Department of Defense components, a Binding Operational Directive framework used during incidents like the SolarWinds hack, and a Communications Sector outreach modeled after programs by International Telecommunication Union. The agency publishes technical advisories informing vendors including Intel, AMD, Qualcomm, and open-source projects like Linux Kernel and OpenSSL. It administers grant programs that fund projects at University of California, Berkeley, Georgia Institute of Technology, and municipal partners such as City of Austin. Campaigns such as public awareness efforts align with organizations like SANS Institute, Center for Internet Security, and Electronic Frontier Foundation on best practices for patching, multi-factor authentication adoption, and supply chain security.

Partnerships and Collaboration

Partnerships span private sector alliances with companies including Facebook, Apple Inc., Salesforce, and Verizon Communications; coordination with federal agencies such as Department of Energy, Treasury Department, and Environmental Protection Agency; and international cooperation with entities like Interpol and European Commission. The agency participates in information-sharing arrangements resembling those run by Financial Services Information Sharing and Analysis Center and Health Information Sharing and Analysis Center. It engages industry consortia including Cloud Security Alliance and Industrial Control Systems Cyber Emergency Response Team partners to address threats affecting suppliers like Siemens and Schneider Electric.

Controversies and Criticism

The agency has faced scrutiny over perceived tensions between security and civil liberties raised by organizations such as the American Civil Liberties Union and Electronic Privacy Information Center. Privacy advocates have criticized information-sharing practices involving private-sector incident reports and law enforcement coordination with Federal Bureau of Investigation and Department of Justice. Critics in Congress and the private sector have debated the agency's authority, funding levels, and efficacy following high-profile incidents like the Colonial Pipeline cyberattack and the SolarWinds supply chain compromise, with commentators from media outlets such as The New York Times and The Washington Post analyzing its responses. International observers have questioned transparency in cross-border data handling in engagements with partners like Russian Federation and People's Republic of China on transnational cybercrime.