CISA turns 5 and looks to the future

On November 16, 2018, the Cybersecurity and Infrastructure Security Agency launched as the federal government's go-to cyber policy and incident response shop.

CISA wasn't built from scratch. The agency was assembled from the old National Protection and Programs Directorate at the Department of Homeland Security — a hodgepodge of offices and components designed in the early days of DHS to accommodate cyber and physical security functions.

The bipartisan effort to establish a dedicated cybersecurity agency culminated with the Cybersecurity and Infrastructure Protection Agency Act of 2016.

"It is clear that NPPD has outgrown its current organizational structure as just a headquarters component," former Rep. Jim Langevin, D-R.I., said in support of the bill at the time.

The cyber defense agency is growing up during an increasingly complex and historic moment for domestic and global cybersecurity, with an ever-evolving landscape of newfound threats and foreign adversaries, and where the need for ironclad resilience against attacks has never been more critical. 

“CISA has the building blocks to be an effective cyber defense agency,” said Mark Montgomery, senior director of the Center on Cyber and Technology Innovation at the Foundation for Defense of Democracies. “Over the past few years, Congress has doubled its budget and provided the agency with the needed authorities.”

CISA boasts more than 3,100 employees, having hired twice as many staff over the last two years as it did in the previous two, and currently has a goal to fill over 3,400 full-time positions. That growth has been fueled largely by increased congressional appropriations and a recognition among lawmakers of the agency's apolitical role in safeguarding the nation's digital infrastructure. 

Regional reorg 

In her birthday message to the agency, CISA Director Jen Easterly touted the 2019 reorganization of the agency that "included building a more regional approach to better serve our partners across the nation." As a result, Easterly said, CISA now fields hundreds of security advisors who work with state and local officials and commercial firms to pursue goals of security and resilience across critical infrastructure sectors.

Easterly also highlighted the ongoing "Shields Up" campaign launched to reduce spillover risk from cyber threats posed by Russia's use of cyber weapons in its war against Ukraine, the push in 2020 to secure election infrastructure and the agency's work on supply chain security amid the COVID-19 pandemic.

The agency has "grown in capacity and capabilities, built a vibrant culture, rooted in our core values of collaboration, innovation, service to the nation and accountability to the American people," Easterly said.

Commitment to nonpartisanship

CISA leaders have positioned the agency as a nonpartisan institution since its inception, working with lawmakers from both sides of the political aisle on security initiatives and public awareness campaigns across the country. While CISA weathered a storm of hyper-partisanship in the aftermath of the 2020 presidential election — when then-President Donald Trump fired ex-CISA Director Chris Krebs after Krebs described the election as the "most secure in American history" — the agency’s apolitical positioning has remained largely intact. 

Easterly, who succeeded Krebs after she was confirmed by the Senate in July 2021, has often said that CISA "needs to be a nonpartisan agency" and has described cybersecurity and election infrastructure as "nonpolitical" issues. 

"Jen Easterly has served as an incredible leader, communicator and collaborator both internally and externally," said Scott Jack, former deputy chief information officer of the U.S. Marine Corps and principal consultant for Deep Water Point & Associates. "CISA’s leaders have been thinking about service over self, and the results are being noticed.”

Jack added that CISA has established "invaluable" new public-private partnerships under Easterly, such as the Joint Cyber Defense Collaborative, a collection of over 20 private-sector organizations that have partnered with the agency to improve information-sharing and plan for large-scale cyber events. The flagship public-private collaboration includes agencies like the FBI, Justice Department, National Security Agency and U.S. Cyber Command; private-sector companies like Verizon, Google and Amazon Web Services; and state, local and international government participants. 

The JCDC has developed plans with interagency and private-sector members to help mitigate harmful impacts to U.S. critical infrastructure caused by Russian cyberattacks. Most recently, the collaborative provided participants and the federal government with real-time threat information on major vulnerabilities linked to cybercriminal organizations and foreign adversaries.

What’s next?

Last year, President Joe Biden signaled to Congress that the administration was seeking an update to a 2013 presidential order protecting critical infrastructure. Presidential Policy Directive 21, also known as PPD-21, was created before CISA existed and does not provide adequate protections against today's threats, experts said. 

"A PPD-21 rewrite that does not address CISA’s national risk-management role will fail to fix one of the biggest problems with the existing document," Montgomery told Nextgov/FCW. 

Montgomery added that Congress should further empower CISA so it can better implement minimum security standards across sectors and require sector risk-management agencies to share critical information. 

As CISA’s mission, workforce and responsibilities in protecting the nation against cyber threats continue to grow, it will be important for the agency to maintain its position as the leader in a community of defenders, rather than assuming the role of the sole guardian, experts said.

“CISA clearly can’t be everywhere and focus on everything at the same level,” said Steve Grobman, senior vice president and chief technology officer of the digital security firm McAfee. “CISA will attempt to choose the areas that have the potential highest impact, but that doesn’t necessarily mean they’ll be able to cover everything.” 

Nextgov/FCW Executive Editor Adam Mazmanian contributed to this article.