Letter from the Director
Over the past three and a half years, it has been my immense honor to lead CISA, America’s Cyber Defense Agency and the National Coordinator for Critical Infrastructure Security and Resilience. The past decade has seen a significant evolution in the threats facing our nation, from an era of global terrorism to one that includes complex cyber threats to our critical infrastructure from adversary nations including China, Russia, North Korea, and Iran, as well as a range of cyber criminals. At the same time, the evolution of technologies like generative Artificial Intelligence offers the promise of enhanced cyber defenses, providing that these capabilities and the broader technology base that underpins our critical infrastructure are designed and delivered with security as the top priority.
Throughout the year we have remained laser focused on leading the national effort to reduce risk to the cyber and physical infrastructure Americans rely on every day, working collaboratively to win and maintain the trust of our myriad partners, including industry, state and local officials, and the election stakeholder community. As the federal government lead for election infrastructure security, we were particularly proud to stand shoulder-to-shoulder with election officials across the nation to support their tireless efforts to deliver safe, secure, free, and fair elections, setting the stage for the peaceful transfer of power in January.
As you read through our achievements from the past year, know that all of our work is underpinned by CISA’s core values—collaboration, innovation, service to the nation, and accountability to the American people. And, of course, executed by our incredibly talented and dedicated team.
Election Security
Since the designation of election infrastructure as critical infrastructure in 2017, CISA has proudly served as the lead federal government agency for the subsector. In this role, CISA has worked extensively with state and local election officials across the country, election technology and service providers, and federal partners to ensure the security and resilience of our Nation’s election infrastructure. This year in particular, CISA staff from across the agency surged to support the cyber and physical security and operational resilience of election infrastructure for the 2024 general election cycle.
At the start of the year, CISA launched our #Protect2024 campaign—a suite of security products, services, and trainings for the election security community to help them more easily and effectively prioritize security and resilience efforts while simultaneously administering elections. As part of this, CISA launched the #Protect2024 webpage that served as the central hub for CISA’s election security guidance products and public releases. Since its launch, the #Protect2024 site has amassed over 235,000 views and served as the release site for 17 new security guidance products. The website also housed the release of 6 joint public statements by CISA, FBI and the Office of the Director of National Intelligence on foreign government activity targeting our election infrastructure.
Another major component of this mission was to ensure the American public understood the incredible work being done by the election infrastructure community. It is because of their efforts and those of public and private security partners that going into the 2024 election cycle our election infrastructure was more secure, and the election community better prepared, than ever before. These messages were emphasized at numerous public engagements, to include a range of national level media appearances, by the Director Easterly and the CISA team reaching an audience of over 65 million viewers.
In order to help stakeholders manage and reduce risk as they prepared to administer elections in 2024’s complex threat environment, CISA recognized the importance of doing more to meet our election stakeholders where they are, addressing their unique needs and requirements. That’s why CISA invested additional resources into our field staff, to include hiring 10 regional election security advisors—former election officials who collectively brought over 200 years of election security and administration experience to CISA. We also cross-trained CISA security experts to increase our field capacity enabling CISA to conduct more physical security assessments across the country. As a result, CISA provided more services to more stakeholders in more jurisdictions than ever before. Since January 2023, CISA conducted over 700 cyber assessments and nearly 1300 physical security assessments for election stakeholders across the country. Additionally, CISA provides almost 1,000 election infrastructure stakeholders with weekly cyber vulnerability scanning reports.
Resilience is rooted in preparation, especially when you are preparing to manage a range of potential threats from cyber to physical to operational risk. That’s why CISA made training availability to election stakeholders a top priority. Overall, since January 2023, CISA has provided 200 tabletop exercises and over 500 election security related trainings, in total reaching more than 30,000 participants.
One very important part of this effort is CISA’s annual Tabletop the Vote Exercise which is conducted in coordination with the National Association of Secretaries of State and the National Association of State Election Directors. This year marked the seventh annual tabletop exercise and brought together members of the election infrastructure community to walk through hypothetical incidents and corresponding response and recovery efforts. This year’s exercise included more than 1,250 participants from dozens of states and territories and a wide range of federal government partners.
CISA Goes Live!
This year, audiences across the nation and around the globe got to know more about CISA and its mission through our new series of 30-minute, topical live events hosted on the LinkedIn Live platform. CISA hosted 12 CISA Live! events in 2024, offering thousands of live participants across LinkedIn, Facebook, X, and YouTube a chance to learn more about CISA's mission and ask questions of key experts and leaders, including CISA’s Director and top officials representing several of CISA’s federal partners. CISA Live! events featured engaging discussions on issues ranging from secure elections, to cybersecurity in the healthcare sector, to the Secure by Design initiative, to cyber threats from the People's Republic of China, and more. Some of this year’s events are embedded through the report, and you can visit cisa.gov/live to see all our past events.
Secure by Design
Starting in 2023, CISA has worked to shift the burden of cybersecurity away from consumers and back to technology producers. Its Secure by Design program works to raise awareness of, and gain buy-in to, the fundamental idea that technology manufacturers should take ownership of customer security outcomes, embrace radical transparency and accountability, and lead from the top.
Throughout FY 2024, CISA made meaningful progress toward safer and more secure technology products for everyone. This included updating foundational guidance and expanding international partnership on this issue.
Key highlights include:
- Principles and Guidance: CISA, along with 17 U.S. and international partners, published updated guidance emphasizing three core principles: taking ownership of customer security outcomes, embracing radical transparency and accountability, and leading from the top.
- Global Impact: CISA, the National Security Agency (NSA), the Federal Bureau of Investigation (FBI), and 14 international partners provided the recommendations in this guide as a roadmap for software manufacturers to ensure security of their products.
- Industry Pledge: More than 250 software manufacturers have committed to the Secure by Design Pledge, which includes pledging to increase usage of multi-factor authentication (MFA), reduce vulnerabilities, and increase installation of security patches.
- Actionable Alerts & Recommendations: CISA provided actionable recommendations to technology manufacturers and guidance on adopting memory safety roadmaps. We also developed a new alert series linking breaches to product defects. A recent alert highlighted SQL injection vulnerabilities which continue to be exploited despite known prevention methods.
- Procurement: CISA also released the Secure by Design guide for those purchasing software. This guide lists questions customers can ask of their vendors and discusses why each security element matters to their organization.
Looking to 2025 and beyond, CISA will continue to expand its efforts to drive awareness and action among software manufacturers and technology users; explore how educational communities can incorporate security into computer science and coding programs to build a future workforce that prioritizes secure design; and gain insight into the economic forces impacting software security to better understand and address the root causes of vulnerabilities.
Tech leaders and global partners pledge to prioritize consumer and public security in their product development.
On May 8, 2024, CISA announced that leading technology companies have committed to our Secure by Design Pledge, prioritizing security in their products from the outset. This initiative marks a significant milestone as companies take public responsibility for their customers’ security, aiming to prevent exploitable defects and enhance visibility over intrusions.
To date, over 250 companies have signed on to the pledge, including some of the largest tech giants on the globe, representing a wide range of domestic and international companies and industries. These manufacturers have pledged to demonstrate measurable progress towards seven specific goals within a year, with flexibility in how they achieve and demonstrate these criteria across their products.
Artificial Intelligence
In our role as the nation’s cyber defense agency and the National Coordinator for security and resilience for critical infrastructure, CISA is managing the opportunities and risks that AI introduces at the nexus of cybersecurity and critical infrastructure.
Since releasing CISA’s Roadmap for AI in late 2023, we have hit several major milestones, including completing our first set of annual AI risk assessments for critical infrastructure sectors in January. These sector-specific risk assessments assessed how AI might make critical infrastructure more vulnerable to critical failures, physical attacks, and cyber-attacks. Shortly after, DHS released new safety and security guidelines, which leverage findings from these assessments and provide recommendations to mitigate cross-sector AI risks for critical infrastructure.
In June, we hosted the federal government's first tabletop exercise on AI cybersecurity incidents, bringing together more than 100 AI experts from government, industry, and international partners to enhance operational collaboration. This was followed by a second exercise in September. These exercises contributed to the development of the forthcoming AI Cybersecurity Collaboration Playbook, which will provide the AI community—including AI providers, developers, and adopters—with essential guidance on how to voluntarily share cybersecurity incident information.
In July, DHS delivered a report to the White House summarizing CISA’s findings from an operational pilot that explored using AI to detect software vulnerabilities in deployed U.S. government systems.
In August, CISA established the role of Chief AI Officer, institutionalizing our efforts to use AI for cybersecurity and help ensure critical infrastructure partners design, develop, and adopt AI in ways that are safe and secure. CISA has also been focused on building AI expertise within the Agency, through upskilling internal talent and hiring externally.
In November, CISA joined interagency partners to serve as a founding member of the Testing Risks of AI for National Security (TRAINS) taskforce, focused on testing advanced AI models across national security domains. CISA will contribute cybersecurity expertise to support the task force’s efforts. This partnership is part of CISA’s growing work on AI security evaluations.
CISA has also produced several products to promote Secure by Design practices in the development of AI systems. Learn more about our AI work by visiting cisa.gov/ai.
Cybersecurity
When it comes to critical infrastructure, impacts from a cyber incident can quickly spill to dependent and interdependent infrastructure – or even have an impact on the public. That’s why we work extensively with government and industry partners to provide tools, information, and resources to boost cybersecurity from even before an incident happens. In the event there is an incident, we urge critical infrastructure organizations to let us know. This allows CISA to form a more complete picture of what is happening, deploy resources, render assistance to impacted critical infrastructure when needed, and—importantly—share anonymized information with other network defenders so additional potential victims can immediately take steps to protect and defend their networks. In FY24, CISA has made significant progress to increase cyber incident reporting.
Through the Joint Cyber Defense Collaborative (JCDC), CISA coordinates with operational cybersecurity partners in industry to develop technical information and materials with practical guidance that helps industry prepare for, mitigate, and respond to cyber incidents. In FY24, JCDC released almost 1,300 cyber defense alerts, advisories, and products, including 58 joint-sealed cybersecurity advisories and co-sealed products. These included the first products that CISA had co-sealed with the Czech Republic, Poland, Ukraine, Estonia, Poland, Finland, and Sweden.
CISA’s Pre-Ransomware Notification Initiative (PRNI) is another way we have worked to measurably reduce risk outcomes for critical infrastructure in the United States and allied nations in FY24. These notifications warn entities of early-stage ransomware activity so they can prevent encryption and evict ransomware gangs from their networks. CISA has conducted 3,368 Pre-Ransomware Notifications since the inception of the initiative 2 years ago, with 2,131 conducted this year as of November 2024. These notifications include those sent to hundreds of K-12 school districts; state, local, tribal and territorial government entities; healthcare organizations and hospitals; and other critical infrastructure.
Additionally:
- We also used our Administrative Subpoena authorities, granted by Congress in the 2021 NDAA, to identify and drive mitigation of over 1,200 vulnerable devices used to control critical infrastructure like power plants and water utilities.
- Our Protective Domain Name System (DNS) service blocked 1.26 billion malicious connections targeting federal agencies in FY24, disrupting a significant number of attempted attacks. Many intrusions are enabled by known exploited vulnerabilities. After compromising a victim, malicious cyber actors will generally attempt to contact a known server to steal information from the victim or receive further instructions.
- Malicious actors are continuously seeking to compromise federal websites and applications. Through our Vulnerability Disclosure Platform, legitimate security researchers enabled agency remediation of over 861 vulnerabilities this year, before they could be exploited by malicious actors and bringing the total to over 3,247 vulnerabilities since 2021.
- In FY24, CISA coordinated 845 CVD cases and produced 427 vulnerability advisories. Coordinated Vulnerability Disclosure (CVD) is the process of coordinating mitigation or remediation and public disclosure of newly identified cybersecurity vulnerabilities in products and services with the affected vendors.
As part of our ongoing effort to improve cyber incident reporting, CISA moved our cyber incident reporting form to the agency’s new and enhanced secure CISA Services Portal, which provides increased functionality, including integration with login.gov credentials.
To help guide people reporting cyber incidents through the process, CISA also released a voluntary cyber incident reporting resource. This web page helps visitors understand who should report an incident, why and when they should report, as well as what to report and how. The page also includes information and tools to help reduce cyber risk.
This year, CISA hit a major milestone and made a positive step toward improved cybersecurity for the nation as part of its efforts to implement its requirements under the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) of 2022. On April 4, 2024, CISA published the CIRCIA Notice of Proposed Rulemaking (NPRM), which contains CISA’s proposed regulations for implementing the CIRCIA regulatory program. In response to the NPRM, business and industry; state, local, tribal and territorial entities; individuals; non-profits; law firms; information sharing and analysis centers (ISACs); and members of Congress contributed hundreds of comments and recommendations. CISA is considering this feedback as we develop the CIRCIA Final Rule. Implementing CIRCIA will enhance the cybersecurity of critical infrastructure in the United States and enable CISA to develop insights on the cyber threat landscape to drive cyber risk reduction across the nation and to provide early warning to other entities that may be at risk.
Emergency Communications
During an emergency, connectivity is everything—if someone receives a busy signal or dead air when trying to reach a first responder, it could be the difference between life and death. Unfortunately, during many emergencies, whether natural or man-made, wireless and/or landline phone services might go down or heavy traffic could overwhelm the service. From first responders to field operators, to emergency managers, all those involved in addressing a critical incident need to be able to maintain situational awareness and respond effectively. In every region of the U.S., CISA helps communities be prepared by making sure that they can communicate effectively during both normal operations and emergencies. They do this by working with state, local, tribal and territorial emergency response partners to provide training, tools, workshops, or any other regional support that might be needed.
In FY 2024, the following are just some of the ways that CISA has had an impact on emergency communications:
- Partnering with Industry to Ensure Communication During Crises: On behalf of CISA, the Defense Information Technology Contracting Organization (DITCO) awarded three new ten-year contracts to provide Priority Telecommunications Services (PTS) in the AT&T, Verizon, and T-Mobile networks. In addition, the Government Emergency Telecommunications Service (GETS) added 31,446 new subscribers and CISA worked to add the Wireless Priority Service (WPS) to all government-issued mobile devices for all federal and contractor employees, adding 247,862 new subscribers, sailing past a significant milestone of now having more than 1 million users of CISA's priority capability. The PTS Area Representatives (PARs) conducted 380 engagements with PTS stakeholders to provide training on the services and how they operate.
- Effective Communications in Active Shooter Incident Workshop: Facilitated an Active Assailant Communications Workshop for improving emergency communications in the event of a mass casualty incident (MCI). Participants included 60 individuals representing 21 agencies from across the National Capitol Region (NCR). The Interoperability Continuum, developed by the Department of Homeland Security’s SAFECOM program, served as a framework to address challenges and continue improving operable/interoperable and public safety communications.
- Cyber Resilient 911 (CR911): As part of its mission to enhance the resilience of the 911 ecosystem, CISA engaged with federal and tribal partners to strengthen relationships with tribal communities. This effort included a meeting with the Salt River Pima-Maricopa Indian Community’s police and cybersecurity leaders to gain a deeper understanding of the unique cyber needs of tribal nations. By fostering these connections, CISA not only gathered critical insights but also shared resources to help address the cybersecurity challenges faced by tribal communities.
- Rural Emergency Medical Communications Demonstration Project (REMCDP): CISA’s focus on assisting rural communities with technical solutions to improve the delivery of rural medical care was highlighted once again in FY24 through the administration of a $1 million dollar grant to the Hawaii County Civil Defense Agency. Along with previous years’ recipients, they will be pursuing a demonstration project that could benefit other rural communities across the nation, innovating to close emergency medical communications coverage gaps in mountainous terrain or in spectrum-restricted areas.
To learn more about CISA’s emergency communications efforts, visit Emergency Communications | Cybersecurity and Infrastructure Security Agency CISA.
Secure Our World
As part of CISA’s enduring cybersecurity awareness program that promotes four easy steps to stay safe online, CISA unveiled We Can Secure Our World in May 2024, its second Public Service Announcement (PSA) designed to educate and empower individuals to take proactive steps to keep them safe online. Featuring the loveable Max from the first PSA, it introduces animated character “Joan the Phone,” whose rhyming song lyrics instruct viewers to install updates, make better passwords, resist phishing links, and use multiple factor authentication to protect themselves online. Along with the first PSA in September 2023, Secure Our World has been seen on tv and heard on the radio at airports and retail outlets around the country. Secure Our World was featured at the Super Bowl, in Walmart stores across the nation, in a Good Morning America interview with Director Easterly, and even on the NASDAQ billboard in Times Square. Through widescale social media presence and outreach to partners, Secure Our World is educating the public, small business and governments of all sizes how to be safe online.
Target Rich, Cyber Poor Outreach
Adversaries generally take the easiest route to reach their goal—whether they are trying to get intelligence, disrupt operations, or just extort money. While some critical infrastructure sectors have invested significant time, talent, and resources into securing their internet connected devices and educating their workforce about cybersecurity, some sectors have only more recently started to focus on this area. CISA has been working closely with key sectors to help them understand the threats and increase their security over the past two years, including Water and Wastewater Systems, Education Services and Facilities Subsector (K-12 Community), and Healthcare and Public Health Sector. These sectors often have few resources to invest in security and resilience and are at high risk from adversaries who see them highly desirable targets.
This year, CISA helped reduce risk in the Water and Wastewater Systems Sector by collaborating with the Environmental Protection Agency (EPA) on a variety of efforts to promote cybersecurity. These efforts are part of a broader strategy to ensure that water utility owners and operators can effectively prepare for, respond to, and mitigate the impact of cyber incidents.
CISA and EPA collaborated in the following efforts:
- Published a joint Incident Response Guide with the Federal Bureau of Investigation (FBI) in January 2024. This guide outlines how water utility owners and operators can work with federal partners to prepare for, respond to, and mitigate the impacts of a cyber incident. This guide garnered over 14,000 views and 5,700 downloads.
- Developed a joint Water and Wastewater Cybersecurity Toolkit that consolidates the most relevant EPA and CISA resources for water and wastewater systems to increase their cybersecurity.
- Hosted a joint CISA Live event and co-presenting at multiple conferences and on numerous webinars.
Recognizing the multifaceted challenges encountered by the K-12 community, CISA continued to engage with K-12 schools to heighten their awareness of cyber and physical risks while providing them with access to CISA's existing and forthcoming tools and resources so they can bolster their cyber and physical defenses effectively.
Resources such as CISA’s Protecting Our Future: Partnering to Safeguard K–12 Organizations from Cybersecurity Threats report and toolkit continue to empower K-12 schools and districts, providing tailored recommendations, actionable insights, and vital tools to address cybersecurity risk. SchoolSafety.gov, a comprehensive repository of federal and state resources on a range of school safety topics, proudly celebrated its four-year anniversary.
In 2024, we also
- Assisted the Department of Education in launching the Government Coordinating Council for the Education Services and Education Facilities Subsector, a pivotal step forward in the national effort to enhance cybersecurity across K-12 educational institutions.
- Assisted in launching the U.S. Department of Homeland Security’s newly established Federal School Safety Clearinghouse External Advisory Board, which CISA will administer, fulfilling a key requirement of the Bipartisan Safer Communities Act.
- Published more than ten SchoolSafety.gov issue briefs on various school safety topics, highlighting information, strategies and resources on issues such a targeted violence prevention, K-12 cybersecurity, emergency planning, trauma-informed schools, and bullying prevention.
- Hosted the third annual National Summit on K-12 School Safety and Security, drawing more than 8,300 registrants from the K-12 community.
- Released the Anonymized Threat Response Guidance: A Toolkit for K-12 Schools and accompanying Reference Guide, a co-branded resource with the FBI that provides comprehensive guidance to help local education agencies and their law enforcement and community partners create tailored approaches to addressing anonymous threats.
- Launched a series of companion products based on existing CISA school safety resources to provide tailored and streamlined guides on school physical security for specific members of the K-12 community. Releases in 2024 included the K-12 School Security Guide Companion Product for School-Based Law Enforcement and School Resource Officers and the K-12 School Security Guide Companion Product for School Business Officials.
- Held a CISA Live! event spotlighting physical security for K-12 schools.
- Conducted 27 security exercises for K-12, with 1,441 participants, including a full-scale active shooter exercise in Fauquier County, VA, with over 400 participants.
To learn more about our efforts to support the education community, visit our page for Educational Institutions.
Healthcare continues to be targeted by cyber actors, disrupting patient care, exposing sensitive information and at times creating ripple effects across large parts of the country. Over the past year, CISA continued its close collaboration with the Department of Health and Human Services (HHS) and other healthcare sector partners to improve cybersecurity.
Building on last year’s close collaboration with HHS to develop a joint Healthcare and Public Health Cybersecurity Toolkit, in FY24, we hosted a joint CISA Live! with HHS to discuss current cyber threats to the healthcare and public health sector and free tools and resources available to help prevent, mitigate, and recover from cyber incidents. CISA also partnered with HHS to develop and revise their Healthcare and Public Health (HPH) Cybersecurity Performance Goals (CPGs) and encouraged healthcare organizations to prioritize the HPH Sector-Specific Goals, particularly the essential goals, as they work to strengthen their cybersecurity practices.
Mitigating Nation-State Threats
Advanced Persistent Threat (APT) actors—particularly those backed by the governments of China, Russia, North Korea, and Iran—are well-resourced and engage in sophisticated malicious cyber activity that is targeted and aimed at prolonged network and system intrusion. CISA works to ensure the nation’s critical infrastructure is prepared for and resilient against potential interference from these nation-state adversaries and the agency has produced many cybersecurity alerts and advisories to help critical infrastructure partners understand what types of activities are occurring and what steps they should take to prevent and mitigate nation-state cyber intrusions.
The People's Republic of China remains the most active and persistent cyber threat to U.S. Government, private sector, and critical infrastructure networks, according to the Office of the Director of National Intelligence. Over the past year, CISA has focused on detecting, preventing and mitigating PRC threats; advancing scalable vulnerability reduction for government and critical infrastructure; and increasing awareness, preparedness, and resilience focused on PRC threats and tactics. At the start of the year, CISA mounted a public awareness campaign designed to increase broader understanding of this critical threat, which Director Easterly emphasized in joint testimony with the Directors of the FBI, NSA, and ONCD during a congressional hearing on Chinese government state-sponsored cybersecurity threats. Throughout the year, CISA issued detailed information on PRC threats, such as a joint CSA on the PRC state-sponsored cyber group known as Volt Typhoon, which compromised the IT environments of several critical infrastructure sectors including Communications, Energy, Transportation and Water and Wastewater. We also held a CISA Live event on PRC threats, and CISA subject matter experts participated in numerous speaking engagements to discuss the need for industry partnership to identify PRC threats, review lessons learned, and relay steps that organizations can take to increase their cyber resiliency.
CISA has also continued its strong industry engagement to mitigate PRC threats, coordinating with Sector Risk Management Agencies and subject matter experts for transportation, water, energy, and communications sectors to reduce risk to those sectors. More information about the cyber threats posed by the PRC is available at People's Republic of China Cyber Threat.
CISA develops and shares cyber advisories and alerts to help critical infrastructure understand the risks from other nation-state actors and offers steps to mitigate current risks.
- Russia engages in malicious cyber activities to enable widespread cyber espionage, to suppress certain social and political activity, to steal intellectual property, and to harm regional and international adversaries.
- North Korea leverages cyberattacks to gather intelligence, disrupt systems, and generate revenue.
- Iran’s growing expertise and willingness to conduct aggressive cyber operations make it a major threat to the security of U.S. and allied and partner networks and data.
For information on Nation State Cybersecurity Threats and related information from CISA, visit Nation-State Cyber Actors.
One example of how we are working to help government and industry partners prepare for major cyber incidents—including from nation-state sponsored activity—is through our Cyber Storm exercise series. This initiative provides the framework for the most extensive government-sponsored cybersecurity exercise of its kind, bringing together the public and private sectors to simulate discovery of and response to a significant cyber incident impacting the Nation’s critical infrastructure.
Over three days of live drills in April 2024, CISA’s Cyber Storm IX provided the nation’s critical infrastructure an opportunity to test and improve U.S. resilience, response, and recovery to significant cyber incidents. This year’s scenario drew from the type of cybersecurity threats posed by nation-states and included cloud-based vulnerabilities impacting critical infrastructure, with a focus on food and agriculture. The exercise drew over 2,200 participants from 35 federal agencies, 13 states, over 100 private companies representing 12 critical infrastructure sectors, and eleven partner nations.
Forging Global Alliances
The risks we face are complex, geographically dispersed and do not acknowledge borders. Protection and security of our cyber and physical infrastructure requires the concerted efforts of public and private partners around the globe. Our international allies and partners face the same threats, and CISA’s efforts strengthen their resilience just as their efforts strengthen ours. CISA’s mission relies strongly on effective partnerships and collaboration both at home and abroad, and these partnerships in turn strengthen the bonds between cooperative nations.
CISA has coordinated or contributed to 45+ capacity development engagements with more than 15 partner nations and over 150 international participants using over $400k in interagency funds. CISA has also led or been a part of 400+ activities that have strengthened or established relationships with international partners. For example, we have renewed or entered into five international arrangements; developed or updated two joint workplans or arrangements; supported 10 CISA co-sealed prodcuts; and provided approximately 55 monthly products or services to CISA and the interagency. Each of these efforts establish frameworks for deeper relationships with foreign partners.
CISA also maintains an Attaché to the United Kingdom, who has participated in hundreds of engagements and events spanning 16 critical infrastructure sectors, resulting in improved cohesion with one of our most important partners.
On October 29, we released our first International Strategic Plan to improve coordination with our partners, advance international relationships to strengthen the security and resilience of our critical infrastructure, and focus and guide the agency’s international initiatives through FY 2026.
CISA’s work in Artificial Intelligence (AI) extends globally and includes coordinating with international partners to advance global AI security best practices and principles. We engage with our global partners on AI through forums such as the U.S.-EU Trade and Technology Council and G7. We have worked with our international partners to develop a set of AI security resources for different audiences at every stage of the AI life cycle including the ACSC-led Guidance on How to Use AI Systems Securely and the Joint Guidance on Deploying AI Systems Securely, which provides best practices for deploying and operating externally developed AI systems. We continue to explore partnerships with international partners, especially Australia, Canada, New Zealand, and the U.K., for red teaming guidelines, best practices, and collaboration models for joint AI red teaming exercises.
In 2024, the United States served as chair of the Critical Five (C5). Established as an international forum in 2012, the C5 is comprised of members from government agencies responsible for critical infrastructure protection and resilience in Australia, Canada, New Zealand, the United Kingdom, and the United States.
In collaboration with the U.S. Department of Homeland Security, U.S. Coast Guard, and multiple interagency stakeholders, CISA conducted a series of exercises with government and private sector partners in Indonesia, Japan, and the Philippines. These exercises simulated significant cyber incidents at major international shipping ports to test the preparedness of partner nations and their response policies and procedures to mitigate impacts on regional and international supply chains.
Regional Support
Critical infrastructure is distributed across the nation, so CISA’s hands-on work is executed by field staff. CISA works year-round to understand and address unique risks inherent to different areas of the country.
Established by the Infrastructure Investment and Jobs Act of 2021 and implemented jointly by CISA and the Federal Emergency Management Agency, the State and Local Cybersecurity Grant Program (SLCGP) and the Tribal Cybersecurity Grant Program (TCGP) help eligible entities address cybersecurity risks and threats to information systems owned or operated by—or on behalf of—State, Local, and Territorial (SLT) governments and Tribal governments.
On July 1, 2024, DHS announced awards of more than $18.2 million in grants to more than 30 Tribal governments, representing the largest number of awards ever provided by the Department to Tribal Nations in a single grant program. These are the first grants ever to be awarded under the TCGP which was officially launched in September 2023.
In September 2024, the Department of Homeland Security (DHS) announced the availability of $279.9 million in grant funding for the Fiscal Year 2024 SLCGP. Now in its third year, this program provides funding to help SLT governments enhance their capabilities to detect, protect against, and respond to cyber threats.
With a growing presence in 10 regions covering the country, CISA staff across the nation work directly with stakeholders throughout the year to bring CISA services and resources, where they’re needed.
Some ways CISA executed its mission in the regions this year include:
- Response: After a Russian hacktivist attack on rural water organizations, CISA worked with federal and local partners to strengthen both physical and cyber defenses in vulnerable communities.
- Critical Manufacturing Supply Chain Forum: CISA organized sector-focused forums to share best practices and foster collaboration in securing the supply chain.
- Homeland Defense Collaboration: CISA shared critical infrastructure and risk data to enhance defense planning and risk mitigation efforts.
- Hackathon for Operational Efficiency: CISA organized several cybersecurity hackathons that fostered collaboration and resulted in solutions for outreach, knowledge management and staff development.
- Water & Wastewater Sector Security Summit: CISA partnered with multiple federal agencies to host two multi-day security summits and a follow-on webinar addressing sector vulnerabilities.
Reducing Risk Together
CISA works with government and industry to understand, manage, and reduce risks to the nation's cyber and critical infrastructure. Since this infrastructure is largely owned and operated by the private sector, managing risk is a shared responsibility that private and public industry must tackle together.
CISA publishes customer-focused products to help organizations understand and address their current risk as well as to look further out and start planning for mid-range risks that may emerge in the next three to 30 years.
To help make CISA’s Infrastructure Resiliency Planning Framework (IRPF) easier for communities and other stakeholders to use as they plan for risks that are unique to their area, we published an IRPF Playbook that provides step-by-step guidance for users to help them accomplish key actions within each of the five planning steps discussed in the main IRPF. Additionally, CISA released additional topics as part of its Secure Tomorrow Series Toolkit, which now addresses nine topics ranging from trust and social cohesion to advanced manufacturing to water availability. The Secure Tomorrow Series toolkits allow users to self-facilitate and conduct strategic foresight activities so they can derive actionable insights about the future, identify emerging risks, and develop risk management strategies that, if implemented today, could enhance long-term critical infrastructure security and resilience.
In 2024, CISA improved our ability to produce critical infrastructure risk analysis by improving capabilities within its Suite of Tools for the Analysis of Risk (STAR). STAR is used by risk analysts in CISA to produce more accurate and timely risk assessments, directly improving the nation’s ability to prepare for and respond to threats to critical infrastructure. It provides a more impactful understanding of the cascading impacts of risks and supports the development of data-driven risk mitigation strategies.
Since it was established in December 2018, the Information and Communications Technology (ICT) Supply Chain Risk Management (SCRM) Task Force has played an invaluable role in identifying challenges and developing actionable solutions to enhance global ICT supply chain resilience. The ICT SCRM Task Force helps increase the security and resilience of our ICT supply chains by providing a trusted forum that encourages collaboration and knowledge sharing among Task Force members from the U.S. Government and Communications and IT Sectors, as well as from the broader stakeholder community,
In 2024, the ICT SCRM Task Force:
- Renewed the ICT SCRM Task Force Charter for two more years, an essential step toward continued collaboration and strengthening public-private partnerships. With the extension, the Task Force can continue to leverage its unique partnership to work with public and private sector organizations to identify potential workstreams and increase the utilization of Task Force products, tools, and resources among stakeholders to better manage risks facing the ICT supply chain.
- Hosted the inaugural ICT SCRM Task Force Conference: Innovations in ICT Supply Chain Risk Management on June 12. With over 160 attendees, the conference provided a forum for Task Force members, subject matter experts, and conference participants to come together and showcase Task Force products, tools, and templates that can reduce risk. Participants also joined important discussions related to ICT supply chain threats and emerging technologies that could form the basis for future Task Force workstreams.
- Published the Software Acquisition Guide for Government Enterprise Consumers: Software Assurance in the Cyber-Supply Chain Risk Management (C-SCRM) Lifecycle (Software Acquisition Guide). The Task Force developed the Software Acquisition Guide in response to the core challenges around software assurance and cybersecurity transparency in the acquisition process, focusing primarily on software lifecycle activities. The Software Acquisition Guide provides guidance for addressing software product security principles within the software lifecycle to support software assurance during software design, development, deployment, and operational use. The Guide can be used as a basis to describe, assess, and measure suppliers’ security practices relative to the software life cycle without requiring that acquisition team members become cybersecurity experts.
The Product Marketing Working Group raises awareness of Task Force products by facilitating stakeholder events; creating resources in the form of factsheets, videos, webinars, newsletters; marketing products and resources to maximize access; and collecting feedback through product surveys to refine and enhance Task Force products.
While critical infrastructure is core to CISA’s mission, driving down risk and building resilience is a whole of nation effort. In addition to working with the 16 critical infrastructure sectors, we worked to grow our relationships with state, local, tribal and territorial, as well as private sector and non-profit stakeholders. Through hundreds of engagements around the country, we connected stakeholders with CISA resources; educated the public, small business and organizations on Secure Our World resources to improve basic cybersecurity, and gathered feedback on how the CISA could be helpful. For example:
- CISA worked with the National Governors Association and Council of Governors to update the Cyber Joint Action Plan that reinforces federal and state collaboration on cyber defense.
- CISA grew its relationship with the emergency management community, and for the first time, leadership presented at the Big City Emergency Managers, the International Association of Emergency Managers, and the National Emergency Management Association conferences.
- CISA has engaged with several disability organizations seeking feedback on our products to make them more accessible for the disability community.
- Through our new relationship with the Boys & Girls Clubs of America, we are working with them on products Clubs can use to improve cybersecurity for Clubs and members.
Space systems, and the services they provide, are vital to the nation’s critical infrastructure, and by extension, our national and economic security. Space systems and space-based services face threats and vulnerabilities that could potentially impact critical infrastructure, DHS front line workers, operational missions, and individual citizens. CISA works with the Sector Risk Management Agencies (SRMAs) and critical infrastructure partners to prioritize assessing their reliance on space systems and assets, and the potential cascading impacts on and across sectors if disruptions were to occur.
To mitigate risks, the CISA collaborates with government and industry partners to enhance the security and resilience of space systems and services. In particular:
- Assessing risks to space systems and space-based services to identify vulnerabilities and mitigations
- Delivering risk identification and mitigation training to interagency and private sector stakeholders
- Coordinating with SRMAs and private sector partners to address risks to space systems and space-based services in Sector Risk Assessments (SRA) Cross-sector Risk Assessments (CSRA) in alignment with National Security Memorandum 22 (NSM-22)
- Facilitating partnerships and working groups
- Leading exercises to address gaps and identify sector-specific mitigations
- Publishing resources that outline actionable guidance and mitigations informed by subject-matter experts
NRMC fulfills key leadership roles and serves as a coordinator for the Federal, State, Local, Tribal, and Territorial (SLTT) governments and private sector partners responsible for identifying and mitigating space-based risk to critical infrastructure. In particular:
- Space Systems Critical Infrastructure Working Group (SSCIWG): This CISA-led working group fosters collaboration among federal agencies, state and local governments, industry partners, and other critical infrastructure sectors to enhance space system security and resilience. The Working Group operates under the Critical Infrastructure Partnership Advisory Council (CIPAC) framework and serves as the primary mechanism for DHS to collaborate and coordinate on strategies and policies to enhance space system security and resiliency.
- Positioning, Navigation, and Timing (PNT) Executive Committee (EXCOM): CISA co-chairs the PNT EXCOM, emphasizing the importance of cybersecurity and infrastructure protection to ensure the resilience of critical services. This federal interagency body oversees and coordinates efforts related to PNT systems in the United States, focusing on the availability, reliability, and security of services like the Global Positioning System (GPS) to support national security and economic interests.
- Space Weather Operations, Research, and Mitigation (SWORM) Subcommittee: CISA co-chairs this interagency body organized under the National Science and Technology Council (NSTC). SWORM coordinates federal actions to achieve objectives outlined in the National Space Weather Strategy and Action Plan (NSW-SAP), which mandated the establishment of the Space Weather Advisory Group (SWAG).
- Space Weather Advisory Group (SWAG): As a member of the SWAG, NRMC provides recommendations to the SWORM interagency working group that enhance the United States’ preparedness for and response to space weather events by aligning research to operational strategies and developing an integrated approach to space weather observation.
- Space Information Sharing and Analysis Center (ISAC): The Space ISAC facilitates collaboration across the global space industry to enhance preparedness and response efforts; disseminate timely and actionable information among member entities; and serve as the primary communications channel for space sector member organizations, including satellite operators, manufacturers, service providers, and government agencies.
- National Defense Information Sharing and Analysis Center (ISAC): The National Defense ISAC convene Defense Industrial Base critical infrastructure companies, suppliers, and government stakeholders to share cyber and physical security threat indicators, best practices and mitigation strategies.
National Security Memorandum 22 on Critical Infrastructure Security and Resilience (NSM-22) and 6 U.S.C. § 665d2 require that each Sector Risk Management Agency (SRMA) assess sector-specific risk. NSM-22 directs SRMAs to “identify the most significant critical infrastructure risks to their sector, including key cross-sector risks and interdependencies.” On behalf of DHS, which is the SRMA for eight critical infrastructure sectors, the Cybersecurity and Infrastructure Security Agency (CISA) has conducted Sector-Specific Risk Assessments (SRA) in collaboration with sector partners.
The objectives of the SRAs are to:
- Enhance the security and resilience of critical infrastructure within each sector
- Engage stakeholders and experts to identify significant critical infrastructure sector risks which require collaborative planning
- Assess the likelihood and potential consequences of identified risks
- Inform the cross-sector risk assessment
- Guide mitigation efforts to reduce risk within the sector and across sectors, as appropriate
The risk assessments were developed using CISA’s Sector-Specific Risk Assessment Guidance (June 2024), which applies enterprise risk management best practices to the critical infrastructure risk environment using a scenario-based approach. The methodology is intended to integrate the best available information from a range of qualitative and quantitative inputs to identify and assess the greatest risks to the nation. These risk assessments were developed collaboratively with stakeholders, including federal departments and agencies, state and local government organizations, private sector entities, and members of the intelligence community.
From May to September 2024, a series of workshops and meetings were held through the sector councils to identify risks, drawing on historical incidents, evidence of vulnerabilities, and potential consequences. This collaborative effort also incorporated intelligence from the Office of the Director of National Intelligence Annual Threat Assessment (2024) and the Department of Homeland Security Office of Intelligence & Analysis Homeland Threat Assessments (2024 and 2025), which informed the evaluation of a broad range of complex threats to U.S. critical infrastructure.
CISA has continued its Connected Communities Initiative (CCI) this year, expanding its resource library and offering new opportunities to engage on risks to connected communities and the technologies that underpin them. Connected communities may create safer, more efficient, resilient communities through technological innovation and data-driven decision-making; however, the integration of smart technologies also introduces potential vulnerabilities that, if exploited, could impact economic security, public health and safety, and critical infrastructure operations. Cyber threat activity against operational technology (OT) systems is increasing globally, and the interconnection between OT systems and smart city infrastructure increases the attack surface and heightens the potential consequences of compromise across these environments.
CISA partners with international and domestic government agencies at all levels to share risk mitigation best practices and guidance to help prevent and protect against critical disruptions to connected communities. CISA’s work in this space fosters open dialogue and guides domestic and international partners to adopt appropriate security practices in pursuit of secure and resilient connected communities. Some of our recent publications include:
Next Gen Cyber Workforce
As cyber threats evolve, skilled cybersecurity professionals are more in demand than ever. CISA is committed to helping to expand the pipeline of talent to meet this growing need.
We believe our nation and global networks are strongest when our workforce reflects the full diversity of the American people. That’s why we focus many of our efforts on reaching talent that is historically under-represented in cybersecurity.
CISA’s work in this area ranges from engaging educational institutions and other organizations representing a wide range of potential talent, to engaging directly through mentorship, to financial support for promising efforts in the private sectors. Some of our activities this year included:
- We hosted several engagements with students from Historically Black Colleges and Universities to promote diversity in cybersecurity and encourage the next generation of cyber leaders.
- We continued to partner with Girls Who Code (GWC) on developing pathways for young women to pursue careers in cybersecurity and technology. We also joined GWC’s Cyber Education Alliance which seeks to advance cybersecurity knowledge for youth.
- We also collaborated with Women in CyberSecurity (WiCyS) in several areas, such as its annual conference—which helps organizations recruit, retain, and advance women in cyber—as well as a hiring event. Additionally, more than 10 CISA staff participated in a WiCyS mentorship program that focuses on upskilling and upleveling women as they prepare for advancement at all levels of their cybersecurity career.
- In July, we hosted the inaugural CISA Cyber Social in collaboration with CYBER.ORG, Girl Scouts of the USA, Girls Who Code, and WiCyS to inspire young women to see themselves in cybersecurity. The event featured a Women in Cyber panel discussion with CISA professionals sharing insights into their careers. Approximately 60 attendees joined in person at CISA, with another 40 participating virtually. CISA is looking forward to expanding our regional presence and engagements to better reach our nation’s future leaders.
- We also sponsored CYBER.ORG’s EdCon, providing hundreds of K-12 educators the opportunity to learn more about how to incorporate cybersecurity lessons into their curriculum and their critical role in strengthening tomorrow's cyber workforce.
- Finally, we awarded $3 million to two non-profits in financial assistance funding through the Cyber Workforce Development and Training for Underserved Communities program. This funding is meant to help increase the number of skilled cybersecurity individuals within underserved communities, enabling a diverse perspective that is essential to building a successful cybersecurity workforce.
In addition to expanding the cyber talent pipeline in the private sector, we also need to ensure the federal workforce is filled with the best cyber talent. One way we do this is through the President’s Cup Cybersecurity Competition, which identifies, recognizes, and rewards the best federal cyber talent. Established in 2019, by Executive Order 13870, “Executive Order on America’s Cybersecurity Workforce,” the President’s Cup is a national cyber event designed to train and recognize cybersecurity professionals in the federal workforce. CISA leads and hosts the President’s Cup as part of its mission to expand the size and capabilities of the U.S. cyber workforce. Watch our CISA Live! on the President’s Cup to learn more about the event and the value of cyber competitions in general as a way to encourage new talent.
The fifth annual President’s Cup, held from January to April 2024, featured a nostalgic video game theme. More than 300 teams and 1,400 individual competitors showcased their cyber skills, with seven new departments and agencies joining, including the Federal Bureau of Investigation, Department of Transportation, Department of Defense, and other branches of the U.S military. Visit President’s Cup Cybersecurity Competition to learn about this year’s winners.
CISA @Work
Ever wonder what it’s like to work at CISA? Over the past several years, the agency has invested significant effort into ensuring that CISA attracts, motivates—and retains—talented people to its team so we can stay ahead of the evolving threat environment. This includes living our CISA Culture through core values that guide our actions and core principles representing behaviors that will ensure our individual and collective success.
With the Agency’s first Chief People Officer at the helm, internal groups, such as the Culture Council, Engagement Working Group, Communications Council, and Management Council, drove critical initiatives to advance CISA’s People First culture of excellence.
CISA declared 2024 as the “One CISA: Year of Unity and Resilience,” a unique initiative to emphasize agency and personal resilience and strengthen our agency culture together. In 2024, CISA’s employee engagement reached an all-time high of 75.9% positive, based on 2024 Federal Employee Viewpoint Survey (FEVS) results compared across the past five years.
CISA worked to improve employee engagement and culture in 2024 through initiatives such as:
- CISA Culture Council: This employee-driven workgroup designs and leads culture initiatives and provides recommendations to CISA leaders. 2024 accomplishments included: 1) a “Hybrid Hub” one-stop-shop on CISA Intranet for information on telework, remote work, training and job aids; 2) ‘Thriving in Hybrid’ information sessions associated with workplace flexibilities; and 3) One CISA’s Flexible Work Environment Principles helping to establish norms and expectations.
- Town Hall Series: Unity and Resilience was the theme for more than 40 virtual and hybrid Town Hall events with total employee participation across all events of over 50,000. Speakers ranged from Organizational Psychologist Adam Grant, to NASA's James Webb Telescope Director Greg Robinson, to Neurodiversity expert Theresa Thomas, to Psychological Safety and Resilience expert Dr. Amy Edmondson.
- Inclusion, Belonging, and Well-Being: We held Unity Days and Family Days at CISA headquarters and some regional locations supported by our Employee Association Groups and many offices. Our CISA Cares program reached thousands of employees with support services, holistic well-being training and resources, and the Headspace App.
- New Leadership Development: We launched new programs including new courses for supervisors through executives, a new mentoring program, a new coaching program, and a new shadowing program.
- Talent Development: New programs in FY24 included a new Individual Development Program (96% participation), a new 360-degree feedback program (98% participation), and a new Instructors’ “CISA Teaching CISA” program.
- Workforce Surveys: We launched the “Our Voices are Stronger Together” internal campaign to gather feedback and insights from our workforce across several surveys. CISA achieved 72% participation on the 2024 FEVS, the highest of any DHS Component.
- Leadership Listening Sessions: This series offered an opportunity for members of the workforce to speak directly with leadership each month on various topics concerning the employee experience at CISA.
- Employee Engagement Action Planning. In 2024, every office across CISA participated in action planning and contributed to one of three areas: Improving Decision Processes, Enhancing Talent Management, and/or Increasing Well-Being and Inclusion in the Hybrid Era. Over 900 employees participated in these actions.
- Employee Recognition: We recognized 200 employees in 44 individual and team categories, the highest number of CISA employees ever, in our 2023 Workforce Recognition and Honorary Awards Program. An amazing 100% of our nominations for the DHS Secretary’s Awards were selected, recognizing 112 CISA team members.
- CISA Learning: We launched our new “One CISA” integrated enterprise learning environment for all our users. CISA Learning replaces multiple learning platforms across CISA and serves as the go-to, learning solution for CISA’s workforce and our external partners – free of charge.
- CISAlutions: This platform offers our workforce a way to submit ideas for improving how work gets done at CISA. In FY24, we made it easier for employees to find and use the Student Loan Repayment program, added information on CISA and DHS Employee Association Groups, and streamlined official name change procedures.
Director Jen Easterly and FEMA Administrator Deanne Criswell sat down at our inaugural joint DHS Workforce Town Hall. During a fireside chat, the two leaders discussed CISA and FEMA’s joint resilience mission, their personal leadership journeys, and future partnership efforts. This event underscored the vital role of interagency partnerships across the Department in securing our nation.
On August 16, CISA realized a significant milestone on the road to a permanent, unified headquarters facility when GSA awarded a fully funded, approximately $524 million building construction contract for CISA’s new headquarters on the Department of Homeland Security’s St. Elizabeth campus.
This is an exciting development for the agency, whose headquarters employees currently work out of five, separate commercial-leased locations around town. This current structure creates logistical and other challenges to efficient information sharing and collaboration.
Consolidating these separate locations into a permanent, government owned facility provides CISA a much-needed long-term solution to meet the Agency’s mission and operational need and will help build agency unity. The new location will offer other significant benefits as well, including enhanced security and resilience, closer coordination and collaboration with other elements of DHS, and—importantly—space appropriate for engaging in meaningful collaboration and information sharing with external partners from the private sector, other agencies and international partners.
The project consists of the construction of a new 630,000 square foot federal building that will provide space to house CISA in a new, sustainable, state-of-the-art facility. The investment includes approximately $80 million to purchase low-embodied carbon construction materials including asphalt, concrete, glass and steel, and $35 million to meet high-performance green building standards. These investments aim to promote domestic manufacturing and clean energy industries.
Conclusion
As we close out the year, it is hard to believe just how far CISA has come in just six short years since it was created in November 2018. We are proud of the agency CISA has become and proud of our people and our partners. We did this together.
As we look to 2025 and beyond, it is more important than ever that we continue to strengthen and expand our partnerships at home and abroad. We must join and align our efforts across government, industry, academia, international partners, and beyond. This includes sharing information and implementing appropriate measures to protect our nation’s critical infrastructure and the services they provide.
We are excited to see how CISA evolves as it continues its mission in 2025 under new leadership. We have created a foundation that is strong and capable of meeting the threats we know will only intensify over the coming year, while also maintaining a flexible, innovative mindset so we can adapt to a changing a geopolitical and technological environment as the coming years bring new challenges and opportunities.