The Cybersecurity and Infrastructure Security Agency will focus on understanding risky interdependencies between critical infrastructure, disrupting significant cyber threats and reducing systemic vulnerabilities to promote national resilience, according to a recent internal memo.
Nick Andersen, CISA’s acting director, spelled out the cybersecurity agency’s Fiscal 2027 goals and the information requirements for achieving them in a Nov. 2 memo to agency leaders obtained by Cybersecurity Dive. The memo lists the agency’s three top-line priorities — leading national cyber defense, prioritizing the security of key infrastructure and overseeing nationwide resilience efforts — along with associated activities, intelligence-collection needs and mission-support requirements.
“The intent is to create an organization in which personnel at every level understand where we are focused, what we need to know, why that information matters, and when it must be elevated,” Andersen wrote in the memo, which Nextgov first reported.
The operational guidance comes as CISA — worn down by a series of staff cuts and mission reductions — prepares to enter its third year without a Senate-confirmed director. President Donald Trump on Monday nominated an executive from the data-analytics firm Palantir to lead CISA, but that nomination could face hurdles in the Senate. In the meantime, Andersen, who has led CISA in an acting capacity since February, has been taking steps to provide more durable direction for the agency’s beleaguered workforce.
Many of the priorities in the memo’s new framework emphasize CISA’s partnerships with the business community, especially operators of critical infrastructure and developers of essential technology. Some of those partnerships have frayed in recent years as the agency has reduced its services and its nationwide footprint. One of the framework’s most consistent themes is that CISA should triage its future support in a way that prioritizes the most systemically important organizations.
The memo lists six “operational focus areas,” including reducing risk to “nationally significant infrastructure” through partnerships that target resources “toward the infrastructure, systems, assets, and functions where disruption would create the greatest national consequences.” Another focus area is mobilizing collective efforts with government and industry partners that can “translate shared understanding into coordinated risk-reduction action.”
What CISA says it needs to know
Six “critical information requirements” provide a high-level overview of the data that CISA believes it needs to do its job. One of them asks about “emerging or ongoing threats, incidents, or disruptions” that could produce “significant impacts” on public safety, economic security or other vital societal functions. Another asks about “significant gaps in preparedness” that could prevent companies or government agencies from dealing with significant outages or disruptions.
To answer those questions, CISA will rely on a list of seven “priority intelligence requirements.” Those questions deal with “changes in the national risk environment” that could implicate the country’s ability to deal with attacks; malicious cyber actors’ targeting activities, particularly with respect to operational technology; the nature of supply chains that are vital to critical infrastructure; and the impacts of emerging technologies and geopolitical developments on risk levels and adversary intent.
From there, the memo gets increasingly granular. Thirteen “mission sustainment and resilience requirements” list issues that could affect CISA’s readiness to complete its objectives. Several deal with staffing levels and workforce competencies. Others deal with technological capabilities, including for detecting adversary activity. Still others address communication and information sharing with Sector Risk Management Agencies and critical infrastructure operators.
The memo then lists detailed questions that CISA officials should consider for each priority intelligence requirement. There are five questions about the issue of changes in the national risk environment; the issue of adversaries’ plans to compromise critical networks gets 11 questions.
Andersen instructed CISA managers to incorporate the priorities and requirements into their activities, keep them in mind during day-to-day work, quickly share new information relevant to the requirements and exchange information “across organizational boundaries.”
One of the new framework’s goals, Andersen told agency leaders, is to break down silos that traditionally have existed between CISA’s operating divisions. Without “a common understanding of [CISA’s] priorities,” he wrote, different divisions might take different approaches to collecting information, assessing risks, and reporting up to senior officials.
