The acting director of the Cybersecurity and Infrastructure Security Agency (CISA) said Tuesday that voluntary partnerships with industry are the core of its mission, even as the agency has lost about a third of its staff and shut down several of the advisory bodies that carried those partnerships, The Register reported. For utilities, hospitals, water systems and other infrastructure operators, the message is that federal help will come through programs they choose to join, run by an agency with less capacity than before.

What Happened

Nick Andersen spoke at a virtual public-sector cyber resilience summit hosted by Rubrik, a data security company. According to The Register, he called partnerships the most critical part of CISA's work and said the agency does not see everything because it is not a law enforcement agency, an intelligence agency or a regulator. It relies on information from other government agencies, international partners and the private sector, he said. Describing how CISA draws companies into programs such as CI Fortify, he said, "It's all carrots and partnerships."

CI Fortify asks critical-infrastructure operators to prepare to keep delivering essential services during a geopolitical conflict, when telecommunications and vendors may be unreliable and adversaries may already be inside the operational technology networks that run physical equipment. It centers on two goals. Operators should be able to isolate from third-party and business networks for weeks to months, and to recover by switching to manual operations or replacing components.

RelatedWhite House AI Task Force Plans Breach Warnings From Labs at Its First Meeting

The Register set Andersen's remarks against the agency's recent history. It reported that the Cyber Safety Review Board, the Artificial Intelligence Safety and Security Board, the Critical Infrastructure Partnership Advisory Council, the National Security Telecommunications Advisory Committee and the Secret Service's Cyber Investigations Advisory Board were all shut down under the current administration, though some have since been revived or reorganized under new names. CISA also ended funding for the Center for Internet Security in late 2025, the outlet reported, which affects the Multi-State Information Sharing and Analysis Center, the group that passes threat alerts down to local governments.

About 1,000 people, roughly a third of CISA's workforce, have left since President Donald Trump returned to office, and CISA has committed to rehiring about 300, The Register reported. Citing Federal News Network, it said the latest budget request would eliminate 900 more positions. The White House's fiscal 2027 budget summary proposes cutting CISA's funding by $707 million, CyberScoop reported in April.

Asked about the gap between the message and the cuts, a CISA spokesperson pointed to the reformed councils, CI Fortify and industry exercises such as Cyber Storm X, a nationwide exercise CISA runs with private partners.

The Register's reporter argued that Andersen's emphasis on partnerships rings hollow given the closures. That is the outlet's assessment, not a finding by any oversight body.

Why It Matters

CISA has no general power to order most private companies to improve their security, a limit Andersen acknowledged himself. Its influence depends on how many operators join its programs and how much warning and analysis it can share. Fewer staff and fewer standing forums reduce both.

For boards and executives at infrastructure operators, that shifts more responsibility to the company. CI Fortify's planning asks are concrete and expensive: knowing which control systems are essential, writing plans to run in isolation for weeks or months, keeping backups and rehearsing manual operation. A voluntary program leaves the decision, and the cost, with each operator. Local governments that relied on federally funded threat-sharing through the multistate center face a similar question about where their warnings will come from.

For policymakers, the episode frames the 2027 budget debate. The administration is asking Congress to cut the agency's positions further while its leadership describes partnerships as its most important work.

What to Watch

Watch how Congress treats the CISA cuts in the 2027 budget request, whether CISA meets its commitment to rehire about 300 people, and whether the renamed councils publish work. Any figures CISA releases on CI Fortify participation would show whether a voluntary model can move operators to plan for isolation.