On November 12, 2020, the Cybersecurity and Infrastructure Security Agency put out a press release saying, “There is no evidence that any voting system deleted or lost votes, changed votes, or was in any way compromised.” The same day, its director, Christopher Krebs, indicated he expected to be dismissed. President Trump fired him on November 17, 2020, by tweet, over his comments on the security of the election.
It was a rough moment for an agency only two years old.
From NPPD to CISA
The roots go back to 2007, when the Department of Homeland Security formed the National Protection and Programs Directorate. Its job was to reduce and eliminate threats to U.S. critical physical and cyber infrastructure. The directorate oversaw five subordinate offices, among them the Federal Protective Service and the Office of Biometric Identity Management.
On November 16, 2018, Trump signed the Cybersecurity and Infrastructure Security Agency Act, which created CISA and lifted NPPD to the level of a federal agency. That opened the door to a bigger budget and more authority. The biometric office moved to the DHS Management Directorate; the future of the protective service had not been settled when CISA was created. Krebs, a former NPPD under-secretary, became the first director, and Matthew Travis, a former deputy under-secretary, the first deputy director.
CISA is based in Arlington, Virginia. It oversees all levels of the federal government and works with states to improve cybersecurity against private and nation-state hackers. Its portfolio grew to include protecting the census, managing National Special Security Events and the U.S. response to COVID-19. It has also had a hand in 5G network security, election security and hardening the grid against electromagnetic pulses. The Office for Bombing Prevention leads the national counter-IED effort.
Early actions
CISA issued its first Emergency Directive, 19-01, on January 22, 2019. Titled “Mitigate DNS Infrastructure Tampering,” it warned that “an active attacker is targeting government organizations” using DNS spoofing to run man-in-the-middle attacks. Research group FireEye said “initial research suggests the actor or actors responsible have a nexus to Iran.”
In 2020 the agency launched a website called Rumor Control to rebut disinformation about the presidential election.
Jen Easterly was confirmed as director by voice vote in the Senate on July 12, 2021. Senator Rick Scott had delayed a floor vote over broader national security concerns, saying he would hold it until the president or vice president visited the southern border. Easterly hired staff to monitor online disinformation, work she tied to the nation’s “cognitive infrastructure,” and kept using Rumor Control during the 2021 elections.
What it runs
CISA issues binding operational directives that require federal agencies to act against specific cyber risks. It provides incident response to the federal executive branch and U.S.-based entities, runs the EINSTEIN intrusion detection system on federal networks, and offers cybersecurity tools to agencies through the Continuous Diagnostics and Mitigations program.
In March 2021 it took control of the .gov domain from the General Services Administration. A month later it dropped the registration fee. In January 2023, Cloudflare won a $7.2 million contract for DNS registry and hosting services for the domain.
The 2021 defense authorization act gave CISA power to issue administrative subpoenas to identify owners of internet-connected critical infrastructure devices with specific vulnerabilities. It issued 47 that year. Also in 2021 it released ransomware guidance after a significant jump in attacks, and set up the Cybersecurity Advisory Committee.
In September 2022 the agency released its 2023-2025 Strategic Plan, the first full strategy document since its founding.
Cutbacks
In 2025, CISA began dismantling parts of its organization at the direction of the Trump administration. A lapse in DHS funding in early 2026 forced further cuts, and more than one-third of its staff has been laid off since January 2025. In May 2026 it was reported that the agency had left access keys to several important government functions exposed.
