CISA Resources and Programs for US Organizations

The Cybersecurity and Infrastructure Security Agency (CISA) operates as the primary federal authority for civilian cybersecurity coordination across the United States, covering both federal civilian networks and 16 critical infrastructure sectors defined under Presidential Policy Directive 21 (PPD-21). Established by the Cybersecurity and Infrastructure Security Agency Act of 2018 (Pub. L. 115-278), CISA publishes binding directives, voluntary frameworks, threat advisories, and operational assistance programs that US organizations — public and private — draw upon to manage cyber risk. The digital security providers maintained on this platform include service providers and consultants whose work intersects directly with CISA programs, frameworks, and compliance pathways.

Definition and scope

CISA's statutory foundation is Pub. L. 115-278, which dissolved the former National Protection and Programs Directorate (NPPD) within the Department of Homeland Security and reconstituted its functions under a new agency with elevated operational authority. The agency's jurisdiction spans two distinct but overlapping domains.

The first is the federal civilian Executive Branch (FCEB), encompassing the .gov network ecosystem. Within this domain, CISA issues Binding Operational Directives (BODs) and Emergency Directives (EDs) that carry mandatory weight for federal agencies. BOD 22-01, for example, established the Known Exploited Vulnerabilities (KEV) catalog and required FCEB agencies to remediate cataloged vulnerabilities within defined windows — in some cases as short as two weeks.

The second domain covers voluntary coordination with private sector and state, local, tribal, and territorial (SLTT) governments across the 16 critical infrastructure sectors identified in PPD-21. These sectors include energy, healthcare and public health, financial services, water and wastewater systems, transportation, and communications, among others. Engagement in this domain is non-mandatory for private entities, though CISA may coordinate mandatory reporting under separate statutory authorities such as the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA, Pub. L. 117-138).

CISA is distinct from the National Security Agency (NSA), which holds primary authority over national security systems (NSS) as defined under 44 U.S.C. § 3552, and from the FBI's Cyber Division, which leads criminal investigation and threat actor attribution. CISA's operational role is protective coordination, not enforcement or prosecution.

How it works

CISA delivers services and resources through five primary program categories:

1. Threat intelligence and advisories — CISA publishes Cybersecurity Advisories (CSAs), often jointly with the FBI, NSA, and international partners through the Five Eyes alliance. These advisories identify active threat actor tactics, techniques, and procedures (TTPs) mapped to the MITRE ATT&CK framework. The KEV catalog, updated continuously, lists vulnerabilities confirmed to be actively exploited in the wild.

2. Vulnerability and risk assessments — Through its Cybersecurity Advisors (CSAs) program and the Cyber Hygiene (CyHy) service, CISA provides free external vulnerability scanning and web application assessments to eligible organizations. These are opt-in services requiring a formal enrollment agreement.

3. Incident response coordination — CISA maintains 24/7 operational support through its Central Command. Under 44 U.S.C. § 3553, CISA has authority to direct remediation activities on FCEB systems. For private sector incidents, CISA deploys advisors and technical teams on a voluntary request basis.

4. Frameworks and guidance — CISA co-stewards the application of the NIST Cybersecurity Framework (CSF) for critical infrastructure and publishes sector-specific implementation guidance. The agency also maintains the Secure by Design initiative, which targets technology manufacturers rather than end users.

5. Exercises and resilience programs — CISA administers the Cyber Storm exercise series and the Tabletop Exercise (TTX) package library, which organizations can deploy internally without CISA facilitation.

Engagement with CISA's voluntary programs typically begins through the agency's regional structure — CISA maintains 10 regional offices aligned to FEMA regions — or through sector-specific Information Sharing and Analysis Centers (ISACs) that have formal coordination relationships with the agency.

Common scenarios

Organizations engage CISA resources across a defined set of operational circumstances:

Federal agency compliance — FCEB agencies responding to BODs or EDs operate under mandatory timelines. BOD 23-02, for instance, required agencies to remove specific networked management interfaces from the public internet within 14 days of issuance. Federal procurement teams and agency CISOs reference CISA directives as primary compliance instruments alongside OMB Circular A-130.

Critical infrastructure operators managing ransomware — Healthcare organizations, water utilities, and pipeline operators frequently engage CISA's voluntary incident reporting and technical assistance pathways following ransomware intrusions. CISA's #StopRansomware portal consolidates advisories and the Ransomware Vulnerability Warning Pilot (RVWP), through which CISA proactively notifies organizations of vulnerabilities that ransomware groups are known to exploit.

SLTT governments seeking no-cost assessments — State and local governments without dedicated security operations frequently enroll in CISA's free Cyber Hygiene scanning service, which delivers weekly reports identifying externally visible vulnerabilities, open ports, and misconfigured services. The page provides context for how such government-adjacent resources fit within the broader service landscape.

Software vendors responding to Secure by Design guidance — Technology manufacturers releasing products into federal or critical infrastructure markets increasingly reference CISA's Secure by Design principles — which prioritize memory-safe languages, elimination of default passwords, and reduction of entire vulnerability classes — as part of product development and procurement qualification documentation.

Decision boundaries

Understanding where CISA's authority begins and ends prevents misallocation of organizational resources and clarifies which federal body holds jurisdiction in a given scenario.

CISA vs. NSA — NSA's Cybersecurity Directorate holds primary authority over national security systems as classified under CNSSI 1253. Organizations operating NSS — typically defense contractors, intelligence community components, and certain military-adjacent systems — fall under NSA guidance rather than CISA BODs. The how to use this digital security resource page addresses how practitioners distinguish applicable frameworks by sector and system classification.

CISA vs. FTC — The Federal Trade Commission holds enforcement authority over data security practices for commercial entities under Section 5 of the FTC Act and the Safeguards Rule (16 C.F.R. Part 314). CISA does not enforce commercial privacy or data security standards; its mandate is infrastructure protection and resilience coordination.

CISA vs. HHS/OCR — Healthcare organizations subject to HIPAA Security Rule requirements (45 C.F.R. Parts 160 and 164) receive enforcement oversight from HHS Office for Civil Rights, not CISA. CISA's healthcare sector engagement is advisory and coordinative — it operates through the Health and Public Health (HPH) Sector Coordinating Council structure established under PPD-21.

Voluntary vs. mandatory engagement — For private sector entities outside the FCEB, all CISA technical services — vulnerability scanning, incident response support, tabletop exercises — remain voluntary unless a separate statute mandates reporting. CIRCIA's final rulemaking, when promulgated, will impose mandatory incident reporting timelines on covered critical infrastructure entities, shifting portions of this interaction from voluntary to compliance-driven. Until final rules take effect, engagement remains at organizational discretion.

The threshold distinction for most organizations: if a system is a federal civilian .gov asset, CISA's BODs and EDs are binding instruments. If the system is privately owned critical infrastructure, CISA functions as a coordination and resource partner, not a regulator.