The Cybersecurity and Infrastructure Security Agency is preparing employees for a reorganization that will reduce the depleted agency’s focus on certain missions in order to emphasize operational technology security and other high-profile goals.
Nick Andersen, the executive assistant director of CISA’s Cybersecurity Division, delivered a warning about the shifting priorities at the resource-constrained agency during a town-hall meeting for CSD staffers on Thursday afternoon. Two people familiar with the matter described the meeting to Cybersecurity Dive, both of them requesting anonymity to speak freely.
One of the people paraphrased Andersen as telling staffers, “There are some people in this room in programs we are going to turn off.” Another person confirmed that warning and said the elimination of certain missions was meant to help CISA “focus on its priorities.” The first person said Andersen told employees that they would have to do a lot more work “with a lot less people.”
The comments from Andersen, one of CISA’s few Trump administration appointees, come as the nation’s lead cyber defense agency is still reeling from a year of layoffs, retirements, scandals and mission changes, all of which have weakened morale and alienated or alarmed some of the agency’s key partners.
During Thursday’s staff meeting, Andersen described the new “strategic intent” for CISA’s cyber division, the agency’s flagship arm responsible for everything from monitoring government networks to analyzing threat information from outside sources. The division, he said, will now focus on delivering cybersecurity intelligence to partners; promoting “national cybersecurity defense” through collaborative planning and operations; and marshaling the resources of the government and its partners to “secure the national cybersecurity environment,” ensuring that CISA deploys its limited resources “where they matter most.”
Employees can “expect clear priorities, stronger coordination, and [an] increased opportunity to contribute” to the cyber division’s success, the presentation said. It said employees would be expected to focus on “delivering insights [to partners] that are actionable, relevant, and aligned to real-world needs.”
CISA plans to publish a cyber division strategy document that explains the reasons for its focus on certain mission areas, followed 60 days later by an implementation plan that will attach detailed timelines and performance measures to those priorities.
Operational technology ambitions
The Trump administration wants CISA to increase its focus on helping critical infrastructure organizations secure their OT.
Andersen told staffers that CISA has “a unique responsibility to the nation” to help water treatment facilities, power plants and other OT users defend themselves from cyberattacks, one of the people familiar with the matter said.
That mission is growing more important as nation-state hackers demonstrate an increasing ability and willingness to penetrate industrial systems and either disrupt them or hold them at risk for use as leverage in a future armed conflict. Andersen alluded to that danger by delivering a warning that one person paraphrased as, “In five to 10 years, we may have a cyber incident where your friends and family may be without drinking water.” He told staffers that CISA needed to prepare for “a [Hurricane] Katrina-like event with a cyber nexus.”
But Andersen also warned that it would be difficult for CISA to increase its OT expertise. He cited that as one of several challenges facing the agency that could take five to 10 years to solve, according to one person. The Trump administration’s purge of CISA’s workforce, which significantly weakened the agency’s reputation in the cybersecurity community, will likely hinder its efforts to recruit technical talent.
“OT resilience will be a HUGE lift” for CISA, said one of the people familiar with the matter.
