Post

Scoop: CISA is ending six free cybersecurity assessments for critical infrastructure operators, significantly reducing the hands-on guidance it offers to those organizations even as it tries to rebuild and reassert its value: www.cybersecuritydive.com/news/cisa-cy...

CISA says these "legacy assessments" are no longer necessary because infrastructure operators can just reference the Cybersecurity Performance Goals. But experts say the CPGs aren't a replacement for the discontinued assessments, which involved hands-on guidance from CISA field advisers.

CISA has been scaling back its services as the Trump admin has slashed its staff, and this latest move has further inflamed tensions. "It’s just so damn depressing," a person familiar with the matter told me, "when [leaders] don’t have a clue how hard it is to help stakeholders without any tools."

There are also some internal CISA tensions behind the elimination of these assessments. CSD develops the tool that they run on and analyzes its data, but IOD's field staff uses the tool in engagements w/ partners. CSD doesn't want to support the tool anymore. IOD is not happy.

"I don't know if [acting CISA Director] Nick Andersen truly understands what the fallout will be if he truly decides to prevent us from doing these assessments," the person familiar with the matter told me.