CISA - Cybersecurity and Infrastructure Security Agency

The Cybersecurity and Infrastructure Security Agency (CISA) is the U.S. federal agency responsible for protecting civilian critical infrastructure from cyber and physical threats. Established by the Cybersecurity and Infrastructure Security Agency Act of 2018, CISA operates within the Department of Homeland Security and serves as the U.S. national coordinator for critical infrastructure security and resilience.

CISA's Core Programs

• Known Exploited Vulnerabilities (KEV) Catalog: a continuously updated list of vulnerabilities known to be actively exploited, with required patching deadlines for U.S. federal civilian agencies
• Binding Operational Directives (BODs): mandatory requirements for federal civilian agencies, including BOD 22-01 (KEV patching) and BOD 23-02 (exposed management interfaces)
• Joint Cyber Defense Collaborative (JCDC): public-private operational collaboration for cyber defense
• StopRansomware.gov: ransomware-focused resources and reporting portal
• CIRCIA: incident and ransom payment reporting program for critical infrastructure

Reporting Incidents to CISA

Critical infrastructure entities can report incidents to CISA voluntarily today and will be required to do so under CIRCIA once the final rule takes effect. Reports go through report.cisa.gov, regional CISA Cybersecurity Advisors, or the JCDC channel. CISA provides incident coordination and threat intelligence in return for reports.

CISA and Other Agencies

CISA coordinates with the FBI (Cyber Division and IC3), Secret Service (financial cybercrime), NSA (signals intelligence and U.S. government cyber defense), and sector-specific agencies (HHS for healthcare, FERC and DOE for energy, FDIC and OCC for banking, FAA for aviation). FBI engagement is required for active investigations; CISA engagement is appropriate for technical incident coordination.