Post

CISA says these "legacy assessments" are no longer necessary because infrastructure operators can just reference the Cybersecurity Performance Goals. But experts say the CPGs aren't a replacement for the discontinued assessments, which involved hands-on guidance from CISA field advisers.

CISA has been scaling back its services as the Trump admin has slashed its staff, and this latest move has further inflamed tensions. "It’s just so damn depressing," a person familiar with the matter told me, "when [leaders] don’t have a clue how hard it is to help stakeholders without any tools."

There are also some internal CISA tensions behind the elimination of these assessments. CSD develops the tool that they run on and analyzes its data, but IOD's field staff uses the tool in engagements w/ partners. CSD doesn't want to support the tool anymore. IOD is not happy.