Post

Scoop: CISA is ending six free cybersecurity assessments for critical infrastructure operators, significantly reducing the hands-on guidance it offers to those organizations even as it tries to rebuild and reassert its value: www.cybersecuritydive.com/news/cisa-cy...

Eric Geller

@ericjgeller.com

2 Sept

CISA says these "legacy assessments" are no longer necessary because infrastructure operators can just reference the Cybersecurity Performance Goals. But experts say the CPGs aren't a replacement for the discontinued assessments, which involved hands-on guidance from CISA field advisers.

Eric Geller

@ericjgeller.com

2 Sept

CISA has been scaling back its services as the Trump admin has slashed its staff, and this latest move has further inflamed tensions. "It’s just so damn depressing," a person familiar with the matter told me, "when [leaders] don’t have a clue how hard it is to help stakeholders without any tools."

Eric Geller

@ericjgeller.com

There are also some internal CISA tensions behind the elimination of these assessments. CSD develops the tool that they run on and analyzes its data, but IOD's field staff uses the tool in engagements w/ partners. CSD doesn't want to support the tool anymore. IOD is not happy.

2/9/26, 3:01 pm0 reposts15 likes

Eric Geller

@ericjgeller.com

2 Sept

"I don't know if [acting CISA Director] Nick Andersen truly understands what the fallout will be if he truly decides to prevent us from doing these assessments," the person familiar with the matter told me.

Eric Geller

@ericjgeller.com

2 Sept

For CISA's part, acting CSD head Chris Butera says eliminating the "legacy assessments" will "reduce redundancy for CISA and organizations requesting an assessment." "CISA routinely evaluates our services and tools to make necessary changes to improve,” he said.