CISA

What is CISA?

CISA (Cybersecurity and Infrastructure Security Agency) is the U.S. federal agency within the Department of Homeland Security that protects the digital and physical critical infrastructure of the United States against cyber threats, sabotage and other disruption. CISA acts as the national coordinator for sixteen critical infrastructure sectors, from energy and water to chemicals and manufacturing. For OT professionals outside the U.S., CISA matters above all as a source: its ICS advisories, the KEV catalog and the joint guidance it publishes with partners such as the Dutch NCSC are free and usable worldwide.

🧠 How was CISA created and how is it organised?

CISA was established by the Cybersecurity and Infrastructure Security Agency Act, signed on 16 November 2018. The agency succeeded the National Protection and Programs Directorate (NPPD) of the Department of Homeland Security (DHS). Earlier units such as ICS-CERT, the U.S. CERT for industrial control systems, were absorbed into CISA.

CISA has three core missions: cybersecurity, physical infrastructure security and emergency communications. Its remit covers both IT and OT networks. The agency is a coordinator and adviser, not a regulator with the power to fine companies. Only for U.S. federal agencies can CISA issue mandatory instructions, known as Binding Operational Directives.

Since 2025 CISA has shrunk considerably: according to public accounts, more than a third of its workforce has left. Funding lapses have also slowed its work. Its core OT products, such as advisories and the KEV catalog, are still being published.

🔧 What does CISA actually do for OT and ICS?

For ICS owners and operators these services matter most:

• ICS advisories - warnings about vulnerabilities in PLCs, HMIs, SCADA software and RTUs, listing affected versions, the CVSS score and the vendor’s mitigations
• KEV catalog - the list of CVEs that are demonstrably being exploited, published since November 2021
• Joint cybersecurity advisories (AA series) - analyses of specific attack campaigns with indicators and MITRE ATT&CK for ICS techniques
• Guidance and fact sheets - covering among other things asset inventory, zero trust in OT and secure OT communication
• Free tools - such as CSET (Cyber Security Evaluation Tool), developed with Idaho National Laboratory and released as open source
• Coordination - CISA funds the CVE programme operated by MITRE works with NIST, the FBI, the NSA and foreign partners, and exchanges information with sector ISACs (Information Sharing and Analysis Centers)

Advisories follow a fixed numbering scheme. An ICS advisory is called, for example, ICSA-26-279-06: year 2026, day 279 of the year, the sixth advisory of that day. Medical devices get the prefix ICSMA. A single week often brings dozens of them, covering familiar names such as Siemens, Schneider Electric, Rockwell Automation and Hitachi Energy.

📚 Which CISA publications matter most for OT?

The CPGs are meant as a minimum baseline, not a complete framework. Version 2.0 adds the Govern function and merges the formerly separate IT and OT goals. Sectors such as chemicals and energy also have their own Sector-Specific Goals.

🏭 Which OT incidents showed the value of CISA?

CISA advisories often describe attacks in detail, so that operators elsewhere can learn from them:

• Unitronics PLCs (advisory AA23-335A, December 2023) - Iran-affiliated actors operating as CyberAv3ngers took over internet-exposed Unitronics Vision PLCs that still had a default password or none at all. At least 75 devices were affected, 34 of them in the U.S. water sector.
• Volt Typhoon (advisory AA24-038A, February 2024) - CISA, the NSA, the FBI and partners warned that a Chinese state actor was pre-positioning itself in critical infrastructure, with knowledge of paths into OT systems.
• Colonial Pipeline (2021) - the ransomware attack on the U.S. fuel pipeline gave fresh impetus to initiatives such as StopRansomware.gov and the CIRCIA incident reporting law.
• Siemens S7 PLCs (advisory AA26-231A, August 2026) - a joint warning from the NSA, CISA, the FBI, the Department of Energy and the EPA about actors who use scanning services such as Censys to find and target these Siemens controllers, with concrete mitigations.

The recurring pattern: OT devices directly exposed to the internet, default passwords and missing network segmentation.

🔄 How does CISA relate to the NCSC and European rules?

CISA is a U.S. government agency. Dutch and other European organisations have no obligations towards it, but they can use its publications freely.

The NCSC regularly co-authors CISA publications. Organisations that must comply with the Dutch Cybersecurity Act can therefore use CISA guidance as a practical way to meet their duty of care, alongside IEC 62443.

🧭 How do you put CISA information to work in your OT environment?

1. Subscribe to the feeds - ICS advisories and KEV updates are available by email, RSS and as machine-readable JSON/CSV.
2. Link them to your asset list - match advisories automatically against your inventory of vendors, models and firmware versions.
3. Prioritise with KEV and context - a KEV flaw in a system reachable from the internet or via remote access comes first; use the CVSS score as a second criterion.
4. Check your baseline against the CPGs - work through the goals or run a self-assessment with CSET.
5. Turn advisories into detection and response - feed indicators and ATT&CK techniques into your SIEM and threat intelligence process, and add the recommended steps to your incident response playbook.
6. Use them in procurement and operations - include Secure by Design principles in requirements for vendors and integrators, and apply least privilege to their access.

Free CISA services such as vulnerability scanning and assessments are intended for U.S. organisations. European companies mainly use the public publications, the feeds and the tools. In this way CISA contributes to situational awareness and defence in depth in Europe too.

❓ Frequently asked questions

What does CISA stand for?

CISA stands for Cybersecurity and Infrastructure Security Agency. It is the U.S. federal agency within the Department of Homeland Security that protects critical infrastructure against cyber and physical threats. CISA has existed since November 2018.

Do European companies have to follow CISA guidance?

No, CISA guidance is not binding on European companies; only U.S. federal agencies are required to follow certain CISA directives. Dutch organisations fall under the Cybersecurity Act and NIS2. CISA publications are nevertheless a valuable, free resource for meeting that duty of care.

What is a CISA ICS advisory?

A CISA ICS advisory is a warning about a vulnerability in an industrial control product, such as a PLC, HMI or SCADA package. The advisory lists the affected versions, the CVE and CVSS details and the vendor’s mitigations. Advisories carry a number such as ICSA-26-279-06.

What is the difference between CISA and the NCSC?

CISA is the U.S. cyber agency and the NCSC is its Dutch counterpart for critical infrastructure operators and government. Both issue advisories and guidance and work together on joint publications, such as the 2025 OT asset inventory guidance. The NCSC is also the CSIRT under the Dutch Cybersecurity Act for most sectors.

What are the CISA Cybersecurity Performance Goals?

CISA’s Cross-Sector Cybersecurity Performance Goals (CPGs) are a baseline set of security controls for IT and OT in critical infrastructure. They first appeared in October 2022, and version 2.0 aligns with NIST CSF 2.0. Each goal is rated for cost, impact and ease of implementation.

Is CISA also the name of a law?

Yes, the acronym CISA is also used for the U.S. Cybersecurity Information Sharing Act of 2015, a law on sharing threat information. That law is separate from the agency CISA created in 2018. In an OT context, CISA almost always refers to the agency.

📌 In summary

CISA is the U.S. agency for cyber and infrastructure security and, through its ICS advisories, the KEV catalog, the CPGs and joint OT guidance, one of the most important free knowledge sources for OT security worldwide. CISA is not binding on European organisations, but its publications fit well with the Dutch Cybersecurity Act, NIS2 and IEC 62443. Link the feeds to your asset list and use them to prioritise vulnerabilities, detection and vendor requirements.