How CISA Coordinates Cybersecurity for Critical Infrastructure Contractors

Last updated 9 months ago. Our resources are updated regularly but please keep in mind that links, programs, policies, and contact information do change.

CISA doesn’t make headlines the way the FBI or NSA does. It operates in the background, coordinating cybersecurity across sixteen sectors of critical infrastructure—everything from power grids to defense contractors to the satellites that route your internet traffic.

CISA’s Role in Critical Infrastructure Protection

CISA, established in its current form through legislation signed in 2018, sits inside the Department of Homeland Security with a mandate to protect systems so important that if they break, the country suffers. Power plants. Water systems. Financial networks. The defense contractors building satellites and spacecraft.

Different agencies have different reporting rules but the same 72-hour deadline, with overlapping but not identical requirements. CISA’s job is to coordinate between these overlapping requirements, translate between regulatory regimes, ensure that when one contractor reports a breach, the threat intelligence reaches other contractors who might face the same attack, and coordinate federal agencies that each have their own authorities, priorities, and acronyms.

CISA is trying to do this with a skeleton crew. The layoffs eliminated its International Affairs office, which coordinated with ENISA and other international cybersecurity agencies.

Known Exploited Vulnerabilities and Federal Patching Requirements

CISA maintains the Known Exploited Vulnerabilities catalog—a running list of security flaws that attackers have successfully exploited in the wild. When CISA adds a vulnerability to the KEV catalog, federal agencies and contractors must patch it by a specific deadline. For contractors, the same obligation flows through DFARS requirements—if your systems are vulnerable and the flaw is in CISA’s catalog, you patch it or face audit findings.

American defense contractors depend on the security practices of international partners who operate under different regulatory frameworks. SpaceX can implement every control in a federal checklist of 110 security practices—NIST Special Publication 800-171. But if SpaceX shares data with ESA for a collaborative mission, and ESA doesn’t patch known vulnerabilities, SpaceX’s data gets compromised anyway.

CISA’s vulnerability coordination can’t fix that structural problem. The agency can add vulnerabilities to the KEV catalog and issue urgent patching directives. What CISA can do is coordinate rapid information sharing so that when one organization’s security failure exposes American contractors, other contractors learn about the vulnerability before they become the next victim.

CMMC Certification and the October 2026 Deadline

While contractors responded to breaches in late December and January, they raced toward a different deadline: a new federal requirement proving contractors have good security.

CMMC Level 1 requires companies to check themselves against 14 basic security practices. CMMC Level 2 requires implementing all 110 NIST SP 800-171 controls and passing a third-party audit.

According to The 2025 State of the Defense Industrial Base Report, 69 percent of contractors claim DFARS compliance through self-assessment. Of the 69% claiming compliance, only 30 percent have completed medium or high assessments that would validate their security posture. That 39% gap—claiming compliance without validation—is where CMMC assessments will find problems.

When assessments find problems, contractors need help understanding what to fix and how to demonstrate that fixes work. CISA’s capacity to provide that guidance has been gutted.

Federal Threat Intelligence Sharing Programs

When contractors report incidents to CISA and the DoD Cyber Crime Center, the agencies analyze them, look for patterns, identify common vulnerabilities and attack techniques, then share that intelligence—with company names and details removed—with other contractors who might face the same threats.

The Automated Indicator Sharing program, established through the Cybersecurity Information Sharing Act of 2015, enables CISA to share cyber threat indicators with private sector partners at machine speed. When one contractor gets compromised, AIS can push indicators to thousands of other organizations within hours.

However, a Department of Homeland Security Inspector General review found that CISA hasn’t finalized plans for AIS continuation beyond September 2025. The program suffers from overreliance on single data contributors and hasn’t convinced enough companies to participate. A system that should have rapidly distributed breach indicators to aerospace contractors faces structural problems that limit its effectiveness.

The Joint Cyber Defense Collaborative was supposed to fill gaps in automated sharing. The JCDC brings together government and industry leaders to discuss sensitive threats, develop collective defensive strategies, and coordinate response to significant incidents. One person familiar with the situation told Cybersecurity Dive that the collaborative’s ability to “manage communication between CISA and other federal agencies”—over 100 agencies across the federal government—depends on contractor support staff to manage communications and coordinate meetings.

International Cybersecurity Coordination

CISA and ENISA—the European Union Agency for Cybersecurity—signed a working arrangement in late 2023 to enhance cooperation on capacity building, best practices, and information about current cybersecurity threats. CISA can share threat intelligence with ENISA about hacker groups. ENISA can provide CISA with forensic details about breaches that help American contractors understand attack methods and vulnerabilities.

The arrangement depends on regular communication between agencies, technical staff who know their counterparts, established channels for sharing classified and unclassified information, and trust built over years of collaboration.

CISA’s International Affairs office maintained those relationships. The office coordinated with ENISA, with the UK’s National Cyber Security Centre, with cybersecurity agencies across allied nations. When an incident occurred, the International Affairs staff knew who to call, what information could be shared under what authorities, and how to determine what information can be shared and with whom.

Michael Daniel’s observation about losing “specialized personnel who manage those deep relationships” and the resulting loss of “institutional knowledge, trust built over years, and the agility needed to respond to sophisticated nation-state and criminal threats” reflects the concrete impact of these cuts.

Contractor Incident Response Requirements

DFARS clause 252.204-7012 requires contractors to report breaches within 72 hours, conduct forensic investigation to determine what was compromised, fix the problem to kick out attackers, and document everything.

The regulations assume contractors have teams trained to investigate breaches and respond to attacks. Many don’t. Small and medium defense contractors—the subcontractors who manufacture components, provide specialized services, handle logistics—often lack dedicated cybersecurity staff. They’re supposed to implement the same 110 NIST SP 800-171 controls as major defense primes, conduct the same forensic investigations, and meet the same reporting deadlines.

CISA provides guidance documents and best practice recommendations to contractors struggling with compliance. Or it did, when it had sufficient staff.

The National Cybersecurity Incident Response Plan—updated in draft form in late 2024—identifies four lines of effort: system response (protecting and restoring computer systems), threat response (finding and stopping attackers), intelligence support (sharing information about the attack), and support for affected companies.

For contractors, “affected entity response” means CISA should provide guidance on what to do, help coordinate with other federal agencies, and ensure contractors aren’t receiving conflicting requirements from different parts of the government. The draft NCIRP recognizes that “private sector entities must have clear visibility into how they plug into federal coordination efforts and how they can access federal support during incidents.” The practice, especially after staffing cuts, looks different from this theory.

Supply Chain Security and International Partnerships

SpaceX can implement perfect security controls on its own networks. But when SpaceX shares data with ESA for collaborative missions, SpaceX’s security depends on ESA’s security.

Federal rules require contractors to make their subcontractors meet the same security standards. If a prime contractor like Airbus holds a defense contract and subcontracts portions of the work, those subcontractors must meet the same NIST SP 800-171 requirements. The security obligation flows through the supply chain.

American rules can’t force foreign government agencies to follow them. American regulations can require American contractors to impose security requirements on their American subcontractors. But when contractors work with foreign government agencies, those agencies operate under their own regulatory frameworks, security standards, and patching timelines.

The Department of Defense maintains systems for identifying security risks from partner companies. NIST hosts a federal group discussing supply chain security risks. CISA’s National Risk Management Center identifies widespread security weaknesses across infrastructure.

None of these frameworks can force foreign government agencies to patch their systems or prevent international partners from becoming the weak link that exposes American contractor data. As critical infrastructure becomes increasingly globalized, the security of American contractors depends on the security practices of organizations that American regulators can’t regulate.

CISA’s role is to help contractors identify which partners might be security weak points, understand where their data goes, and make informed decisions about which partnerships create acceptable risk. That requires CISA to maintain relationships with international cybersecurity agencies, understand foreign regulatory frameworks, and help contractors work through the complexity of operating across different security regimes.

CIRCIA Implementation Delay

The Cyber Incident Reporting for Critical Infrastructure Act of 2022 established that critical infrastructure operators must report significant hacks to CISA within 72 hours. The statute required CISA to publish final implementing regulations by October 2025.

In September 2025, CISA announced the final regulations would be delayed until May 2026. The rule likely won’t take effect until later in 2026.

The delay creates uncertainty about what contractors must do. Without final CIRCIA regulations, contractors face uncertainty about exactly how to decide what counts as a reportable incident and what details to include. The uncertainty compounds during complex incidents that span multiple regulatory regimes and multiple agencies’ jurisdictions.

CISA was supposed to publish the final rule on schedule, implement the reporting portal, and help contractors understand their obligations. The delay suggests CISA lacks the capacity to finalize the rule while managing its other responsibilities and coping with staffing reductions.

Implications for Critical Infrastructure Beyond Defense Contractors

The same vulnerabilities exist throughout critical infrastructure. The same supply chain risks. The same international coordination challenges. The same staffing constraints at the agency responsible for coordinating protection.

In late December and early January: the Manage My Health patient portal in New Zealand compromised 125,000 users’ health information. Trust Wallet lost $8.5 million when attackers compromised a company it relied on. Chinese hackers continued breaking into U.S. critical infrastructure through campaigns by Volt Typhoon and Salt Typhoon.

These aren’t isolated incidents. They show how hackers attack across the world, take advantage of weak security at partner companies, and move faster than coordination systems built for a slower, less global threat environment.

CISA coordinates cybersecurity for the power grid that keeps your lights on, the water systems that deliver clean water, the financial networks that process your transactions, and the telecommunications infrastructure that connects your phone calls. When CISA loses staff and resources to coordinate effectively—when international relationships get severed, when contractor support staff disappears, when stakeholder engagement divisions get eliminated—the coordination gaps affect everyone who depends on critical infrastructure.

Questions About CISA’s Coordination Capacity

Can CISA effectively coordinate incident response across 100+ federal agencies with a skeleton JCDC staff? Without an International Affairs office, CISA can’t maintain international partnerships. Can it provide contractor guidance and support without a Stakeholder Engagement Division?

CISA officially says it’s still doing its job with available resources. CISA still operates the National Cybersecurity and Communications Integration Center, maintains a list of security flaws that hackers are actively exploiting, and coordinates with federal agencies responsible for protecting different industries.

Coordination depends on relationships and trust, not official procedures. It’s about institutional knowledge and the ability to rapidly convene the right people when incidents occur. These relationships and knowledge don’t show up on organizational charts, but they determine whether agencies can work together during crises.

When CISA loses staff who know which companies to contact during emergencies, which international partners to engage, and which federal agencies need which information—the official systems stay in place, but they don’t work as well.

The Path Forward

Contractors will complete forensic investigations, submit required reports, and implement remediation measures. Federal agencies will analyze incidents, share threat intelligence, and update defensive guidance. The attackers will likely move on to other targets.

The underlying problems won’t fix themselves. Weak links in the supply chain, including security gaps at foreign partners that can expose American contractor data, will persist. The international coordination challenges will remain. CISA will remain understaffed unless Congress or the President decides to hire more people.

Contractors race to achieve certification while simultaneously responding to incidents and implementing new security controls. The final CIRCIA rule remains delayed. The threat environment continues evolving faster than defensive measures can keep pace.

CISA published an updated draft National Cybersecurity Incident Response Plan in late 2024, asking for feedback about what the plan is missing regarding critical infrastructure sectors, how state and local governments should help, and how to coordinate internationally. The draft recognizes that private sector entities need clear visibility into federal coordination efforts and access to federal support during incidents.

Contractors need to see how to get help from CISA, and that depends on CISA having sufficient capacity to provide them.

Major contractors have substantial security budgets and sophisticated security teams. But their security depends not on their own investments but on how secure their partners are and on the effectiveness of government coordination mechanisms they depend on.

When coordination mechanisms weaken—when CISA loses the capacity to rapidly share threat intelligence, coordinate international response, and help contractors work through complex compliance requirements—the entire critical infrastructure ecosystem becomes more vulnerable. Not because any single organization failed, but because the coordination systems that hold critical infrastructure together have broken down.

Protecting critical infrastructure in 2026 requires systems that can coordinate at global scale, across regulatory boundaries, with sufficient resources to maintain the relationships and institutional knowledge that make coordination work.

Whether CISA will get more resources, or whether critical infrastructure protection will continue with less coordination, remains an open question. For contractors working through this environment: you have less federal support than you used to. The federal help you could previously count on is now much less available. The international partnerships that facilitated information sharing have been disrupted. The guidance and support that helped you work through complex compliance requirements may not be available when you need it.