Nick Andersen, the new acting director of the Cybersecurity and Infrastructure Security Agency (CISA), said the agency is reaching a “tipping point” in its relationships with critical infrastructure operators as it shifts from building partnerships to operationalizing collaboration.
Securing critical infrastructure is one of CISA’s top priorities, Andersen said during the McCrary Cyber Summit in Washington on Tuesday. To do that, he said the agency is moving away from broad conversations about what critical infrastructure operators should do to specific discussions about coordinated operations.
“It is exceedingly unfair to a critical infrastructure owner [and] operator to say ‘you’re really important, just go secure all the things’ … We need to be able to say, ‘no, you’re really important for the following reason, for the following functional support,’” Andersen said.
Effective collaboration with operators can lead to “real, measurable increases and improvements and resilience for a discrete set of assets,” Andersen said.
Recently, Andersen said those relationships have reached “sort of a tipping point” in maturity – including considerations around what roles owners and operators should play in security, what role the government should play, and whether operators should work with CISA or another agency.
“I think we’ve continued to see sort of evolving and maturing relationships, in particular on the interagency side,” Andersen said. “Those have just been fantastic relationships that really serve as multipliers. I think it’s important … to say objectively who is best placed in order to be able to help achieve a certain outcome.”
Andersen said that means letting the agency best positioned to help – whether that’s the FBI, Department of Energy, or the National Security Agency – lead engagements with critical infrastructure partners.
He noted the goal is to align priorities and build the most effective relationships to boost resilience while avoiding past coordination missteps that created confusion and limited impact.
To get there, Andersen said that owner-operators must be direct about what they need so government and industry can build realistic joint action plans.
“I’m fully aware of that in my role at CISA, no matter what role it has been within the last six months, we absolutely just cannot, cannot do this alone,” Andersen said. “So, when we get to joint work plan development … it needs to be a very, very honest conversation about what is needed.”