CISA Retires Six Critical Infrastructure Assessments

Executive Summary

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has announced the retirement of six free, hands-on cybersecurity assessment services that were previously offered to critical infrastructure organizations. The decision, effective September 7, 2026, will end direct support from CISA's regional staff for these programs. The agency cited a need to reduce redundancy and streamline its offerings, directing organizations instead toward self-service questionnaires and its Cybersecurity Performance Goals (CPGs). The move has drawn concern from some industry experts, who worry that under-resourced entities in sectors like healthcare and water utilities will lose a valuable, no-cost resource for improving their security posture, particularly as CISA prepares to enforce new incident reporting mandates.

Regulatory Details

CISA is discontinuing regional staff support for the following six assessment programs:

• Cyber Resilience Review (CRR)
• Ransomware Readiness Assessment (RRA)
• Incident Management Review (IMR)
• External Dependencies Management Assessment (EDMA)
• Cyber Infrastructure Survey (CIS)
• Cyber Resilience Essentials survey

Previously, these programs involved CISA advisors working directly with organizations to facilitate in-depth evaluations, often using the Cyber Security Evaluation Tool (CSET). This process provided tailored reports and actionable recommendations. Going forward, organizations will be guided to use CISA's self-service tools and the cross-sector Cybersecurity Performance Goals (CPGs) to conduct their own evaluations.

Chris Butera, acting executive assistant director of CISA's Cybersecurity Division, stated the goal is to "reduce redundancy" and improve the efficiency of the agency's services.

Affected Organizations

The primary entities affected are U.S. critical infrastructure operators. This includes a wide range of public and private sector organizations, with a significant impact on smaller or under-funded entities that lack the budget for commercial security consulting services. Key sectors that have historically relied on these free assessments include:

• Water and Wastewater Systems
• Healthcare and Public Health
• Energy
• Transportation Systems
• State, Local, Tribal, and Territorial (SLTT) governments

Impact Assessment

The retirement of these hands-on services creates a potential guidance and support gap for the very organizations CISA is tasked with protecting. While self-service tools are valuable, they lack the interactive, expert-led facilitation that many resource-constrained organizations found beneficial. The hands-on assessments provided not just a report, but a collaborative process that helped teams understand their specific risks and prioritize improvements.

This decision is particularly notable given two external factors:

1. Workforce Pressures: The move is reportedly linked to workload pressures and a significant reduction in CISA's workforce, which may have made the labor-intensive assessments unsustainable at scale.
2. CIRCIA Implementation: CISA is in the final stages of rulemaking for the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA). This act will impose strict, mandatory reporting deadlines on these same critical infrastructure entities. Critics argue that removing a key tool for improving security posture just before increasing compliance burdens is counter-intuitive and could leave many organizations less prepared to meet the new requirements.

Compliance Guidance

With the retirement of these services, critical infrastructure operators should take the following steps:

1. Leverage CPGs: Familiarize yourself with CISA's Cybersecurity Performance Goals. These are designed to be a prioritized subset of security practices that can help organizations make the most impactful improvements. Use the associated self-assessment questionnaire as a starting point.
2. Utilize CSET: The Cyber Security Evaluation Tool (CSET) remains available for download and use. Organizations can still run the tool independently to conduct a detailed assessment against various standards, though they will lack the CISA facilitator.
3. Seek Community and ISAC Support: Engage with your sector-specific Information Sharing and Analysis Center (ISAC). These groups often provide resources, tools, and peer support that can help fill the gap left by the retired CISA services.
4. Prepare for CIRCIA: Proactively begin aligning your incident response plans and capabilities with the expected requirements of CIRCIA. This includes identifying what constitutes a reportable incident, defining roles and responsibilities, and practicing response procedures.
5. Budget for External Assessments: For organizations that relied heavily on the free CISA assessments, it may be necessary to budget for periodic third-party security assessments to maintain an objective view of their security posture.