CISA's CIO talks about the cyber agency's growth and expanding mission

Robert Costello serves as the chief information officer of the Cybersecurity and Infrastructure Security Agency, where he is leading efforts to develop and deploy innovative technology solutions while supporting federal agencies on their path to implementing zero trust architectures. A longtime Department of Homeland Security hand with experience at Immigration and Customs Enforcement and Customs and Border Protection, Costello watched as CISA transformed from the successor to the National Protection and Programs Directorate into the quarterback for the federal cybersecurity team. In this interview, Costello charts the road ahead for CISA and details how the agency has been working to achieve its mission of improving federal agency and public cybersecurity since he joined in 2021. 

The following interview has been edited for length clarity.

FCW: How has CISA grown since it was first established in 2018?

Costello: It's been pretty exciting working in other parts of DHS and seeing how NPPD, and then CISA, has matured. In the short time I've been here, I think you're seeing a tremendous increase in our messaging. The "Shields Up" campaign was really wonderful because it spoke to many different people: You didn't have to be an expert technologist to understand what we were putting out at multiple levels. It spoke to citizens, private corporations, critical infrastructure, and then you could dig down and get more technical or find other recommendations for your day-to-day life. 

We're seeing the agency become a component-level contributor to the rest of DHS. My office is continuing to mature: We're starting to roll out a lot of our own solutions, and starting to offer more services to CISA users. We're also starting to identify that CISA culturally will be different from the other components in a good way. And I'm really concentrating on what the CISA operator needs to accomplish their mission. It'll be very different from when I was at CBP and I was working with the border patrol extensively to outfit those operators with IT. 

FCW: How has the hiring and expansion process been for your team?

Costello: The CIO's office is growing. We've had some really great new hires. I'm really proud of my team, we've done a lot. We're pivoting from more of a compliance-CIO shop to an operational shop, where we're still doing that very important compliance mission, but starting to deliver services and become a true partner to the mission operators in making sure they have those solutions to interact with our partners. 

We've been certainly blessed with some increases to our budget, and on my team I'm definitely seeing a lot of interest in working within the [chief information office]. Typically when we're posting jobs we're getting good applicants, and a lot of applicants. So I'm excited. I think CISA is proving itself to be an agency people want to work with, and work for. 

FCW: Say the next Colonial Pipeline or SolarWinds attack happens. Is CISA more prepared now than it was in the past to respond and provide rapid, effective solutions?

Costello: In the chief information office, we've deployed a lot of new collaboration tools to allow our teams to collaborate in real time with affected customers or private industry that maybe we didn't have previously during other responses. We're also working together, myself and the cybersecurity director, to modernize reporting systems so that we have true systems which allow us to react quickly, know who is working on what and make sure we're sharing information effectively. 

That's really my role as CIO. We are very much working across the line, whether it's in the emergency communication division, the cybersecurity division, the integrated operations division, our field element, and some of our watch and intel functions, we're all working together. I'm proud of how much collaboration I'm seeing at CISA. 

FCW: Are there any CISA projects you're excited about over the next few years?

Costello: We're working on a new transport network for CISA in my office that will take us to the next level in our ability to provide services to our users and connect to our various systems. My office is also going to be relentlessly focusing on the operator, so I'm standing up new functions in our operations area to make sure our field personnel have the same level of IT support as we have here. We're doing a lot of amazing work in the analytics front, and I think you'll see that expand. And like every agency, we're going through our zero trust journey. We're consuming a lot of the CISA services and advice that's available to all CISA customers, but it's a journey that's going to take some time.