Cybersecurity and Infrastructure Security Agency
Agency of the United States Department of Homeland Security
From Wikipedia, the free encyclopedia
The Cybersecurity and Infrastructure Security Agency (CISA) is a component of the United States Department of Homeland Security (DHS) responsible for cybersecurity and information technology infrastructure protection. It oversees all levels of the federal government and coordinates with U.S. states to improve cybersecurity against private and nation-state hackers.[4] The CISA is headquartered in Arlington, Virginia.
- National Protection and Programs Directorate
- Washington, DC, United States
Seal of CISA | |
 Flag of CISA | |
| Agency overview | |
|---|---|
| Formed | November 26, 2018 |
Preceding agency |
|
| Jurisdiction | United States federal government |
| Headquarters |
|
| Motto | "America's Cyber Defense Agency" |
| Employees | 3,641 (2025)[1] |
| Annual budget | $3.0 billion (2025) |
Agency executives |
|
Parent department | Department of Homeland Security |
| Website | www |
The agency began in 2007 as the National Protection and Programs Directorate (NPPD).[4][5] With the Cybersecurity and Infrastructure Security Agency Act of 2018, CISA's footprint expanded to include roles protecting the census, managing National Special Security Events, and the U.S. response to the COVID-19 pandemic. It has also been involved in overseeing 5G network security, securing elections, and strengthening the US grid against electromagnetic pulses (EMPs).[6] The Office for Bombing Prevention leads the national counter-IED effort.[7]
History
The National Protection and Programs Directorate (NPPD) was formed in 2007 as a component of the United States Department of Homeland Security.[8] NPPD's goal was to advance the Department's national security mission by reducing and eliminating threats to U.S. critical physical and cyber infrastructure. The NPPD oversaw five subordinate offices, including the Federal Protective Service (FPS) and the Office of Biometric Identity Management (OBIM).[4]
On November 16, 2018, President Donald Trump signed into law the Cybersecurity and Infrastructure Security Agency Act of 2018 (or CISA Act), which established CISA, effectively elevating NPPD to the level of a federal agency, thereby opening the door to increased budget and authority.[4][9] OBIM was moved out of CISA and into the DHS Management Directorate, while the fate of FPS had not been determined at the time of CISA's creation.[9][10] As of 2020[update], CISA assisted other government agencies, including state and local agencies, and private sector organizations in addressing cybersecurity issues, representing a major expansion of activities beyond those of NPPD.[11] Former NPPD under-secretary Christopher Krebs was CISA's first Director, and former deputy under-secretary Matthew Travis was its first deputy director.[4][10][12]
On January 22, 2019, CISA issued its first Emergency Directive (19-01: Mitigate DNS Infrastructure Tampering)[13] warning that "an active attacker is targeting government organizations" using DNS spoofing techniques to perform man-in-the-middle attacks.[14] Research group FireEye stated that "initial research suggests the actor or actors responsible have a nexus to Iran".[15]
In 2020, CISA created a website, titled Rumor Control, to rebut disinformation associated with the 2020 United States presidential election.[16] On November 12, 2020, CISA issued a press release asserting, "There is no evidence that any voting system deleted or lost votes, changed votes, or was in any way compromised."[17] On the same day, Director Krebs indicated that he expected to be dismissed from his post by the Trump administration.[18] Krebs was subsequently fired by President Trump on November 17, 2020[19] via tweet for his comments regarding the security of the election.[20] According to various reports and statistics, the scale and frequency of cyber-attacks have been steadily increasing in recent years. For example, the number of data breaches reported in 2020 alone reached a record high of 3,932, a 48% increase compared to the previous year, with over 37 billion records exposed globally, and also the average cost of a data breach in 2020 was estimated to be $3.86 million, with an average time to identify and contain a breach of 280 days.[21]
On July 12, 2021, the Senate confirmed Jen Easterly by a voice vote.[22] Easterly's nomination had been reported favorably out of Senate Committee on Homeland Security and Governmental Affairs on June 16, but a floor vote had been reportedly held (delayed) by Senator Rick Scott over broader national security concerns, until the President or Vice President had visited the southern border with Mexico.[23] Easterly hired new staff to monitor online disinformation to enhance what she called the nation's "cognitive infrastructure" and utilized the existing rumor control website during the 2021 elections.[24]
In September 2022, CISA released its 2023–2025 CISA Strategic Plan, the first comprehensive strategy document since the agency's establishment in 2018.[25]
In 2025, CISA began dismantling parts of its organization at the direction of the Trump administration.[26][27] A lapse in DHS funding in early 2026 forced the agency to scale back even more, resulting in the layoff of more than one-third of its staff since January 2025.[28][29]
In May 2026 it was reported that CISA had left exposed access keys to several important governmental functions.[30][31]
Organization
CISA divisions include the:[32]
- Cybersecurity Division
- National Cybersecurity and Communications Integration Center
- Capacity Building
- Joint Cyber Defense Collaborative
- Mission Engineering
- Office of the Technical Director
- Threat Hunting
- Vulnerability Management
- Infrastructure Security Division
- Bombing Prevention
- Chemical Security
- Exercises
- Infrastructure Assessment & Analysis
- School Safety
- Strategy, Performance & Resources
- Emergency Communications Division
- National Risk Management Center
- Integrated Operations Division
- Regions 1 through 10[33]
- Stakeholder Engagement Division
- Council Management
- International
- Sector Management
- Strategic Relations
Programs
The Continuous Diagnostics and Mitigations program provides cybersecurity tools and services to federal agencies.[34][35]
CISA issues "binding operational directives" that require federal government agencies to take action against specific cybersecurity risks.[36]
In March 2021, CISA assumed control of the .gov top-level domain (TLD) from the General Services Administration. CISA manages the approval of domains and operates the TLD Domain Name System nameservers. In April 2021, CISA removed the fee for registering domains.[37] In January 2023, Cloudflare received a $7.2M contract to provide DNS registry and hosting services for the TLD.[38]
CISA provides incident response services to the federal executive branch and US-based entities.
CISA manages the EINSTEIN intrusion detection system to detect malicious activity on federal government agency networks.
The National Defense Authorization Act for Fiscal Year 2021 granted CISA the authority to issue administrative subpoenas in order to identify the owners of internet connected critical infrastructure related devices with specific vulnerabilities. In 2021, CISA issued 47 subpoenas.[39]
In 2021, CISA released a report that provided guidance for how to navigate and prevent ransomware incidents. This was due to a significant jump in recent attacks related to ransomware.[40]
Committees
Cybersecurity Advisory Committee
In 2021, the Agency created the Cybersecurity Advisory Committee with the following members:[41]
- Steve Adler, Mayor, City of Austin, Texas
- Marene Allison, Chief Information Security Officer, Johnson & Johnson
- Lori Beer, Chief Information Officer, JPMorgan Chase
- Robert Chesney, James A. Baker III Chair in the Rule of Law and World Affairs, University of Texas School of Law
- Thomas Fanning, chairman, President and CEO, Southern Company
- Vijaya Gadde
- Patrick D. Gallagher, Chancellor, University of Pittsburgh
- Ronald Green, Executive Vice President and Chief Security Officer, Mastercard
- Niloofar Razi Howe, board member, Tenable
- Kevin Mandia, chief executive officer, Mandiant
- Jeff Moss, President, DEF CON Communications
- Nuala O’Connor, Senior Vice President & Chief Counsel, Digital Citizenship, Walmart
- Nicole Perlroth, Cybersecurity journalist
- Matthew Prince, chief executive officer, Cloudflare
- Ted Schlein, General Partner, Kleiner Perkins; and Caufield & Byers
- Stephen Schmidt, Chief Information Security Officer, Amazon Web Services
- Suzanne Spaulding, Senior Advisor for Homeland Security, CSIS
- Alex Stamos, Partner, Krebs Stamos Group
- Kate Starbird, Associate Professor, Human Centered Design & Engineering, University of Washington
- George Stathakopoulos, Vice President of Corporate Information Security, Apple
- Alicia Tate-Nadeau (ARNG-Ret.), Director, Illinois Emergency Management Agency
- Nicole Wong, Principal, NWong Strategies
- Chris Young, Executive Vice President of Business Development, Strategy, and Ventures, Microsoft
Directors
| No. | Director | Term | |||
|---|---|---|---|---|---|
| Portrait | Name | Took office | Left office | Term length | |
| 1 | Chris C. Krebs | 16 November 2018 | 17 November 2020 | 2 years, 1 day | |
| 2 | Jen M. Easterly | 13 July 2021 | 20 January 2025 | 3 years, 191 days | |
| Acting | Nick Andersen | 26 February 2026 | – | incumbent | |
