IC Technology & Cyber — 2026-09-08

CISA Retires Six Free Cybersecurity Assessments for Critical Infrastructure Amid Workforce Cuts

BLUFSmall critical infrastructure operators now lose their only free standards-based cyber evaluation at the worst possible time, with no credible replacement and CIRCIA reporting deadlines approaching.

CISA confirmed to Cybersecurity Dive that its regional staff will stop performing six free assessments for critical infrastructure operators: Cyber Resilience Reviews, Cyber Resilience Essentials surveys, Ransomware Readiness Assessments, Incident Management Reviews, External Dependencies Management Assessments and Cyber Infrastructure Surveys 12. Acting Cybersecurity Division executive assistant director Chris Butera said the agency is "retiring some legacy questionnaire assessments" to reduce redundancy and will direct operators to its Cross-Sector Cybersecurity Performance Goals questionnaire instead 12. An unnamed person familiar with the matter told Cybersecurity Dive that acting Integrated Operations Division assistant director James Harrell informed field staff at an August 25 meeting to stop conducting the assessments, and that the agency's Cybersecurity Division no longer wants to support the CSET-based tool underlying them 12. The change follows CISA's loss of roughly one-third of its workforce since the start of the second Trump administration 123. Former CISA Cybersecurity Division head Jeff Greene and Cyber Threat Alliance president Michael Daniel both said the CPGs identify priorities rather than provide the standards-based evaluation the retired assessments delivered 12.

Analysis
Ending six free assessments strips small water utilities and municipalities lacking budgets for commercial alternatives of hands-on, standards-based evaluation just as CIRCIA's 72-hour incident reporting mandate nears finalization, and operators without in-house expertise lose the regional advisers who once interpreted results for them. The replacement Cross-Sector CPGs questionnaire identifies priorities rather than measuring compliance against specific standards, former CISA officials say, leaving operators without a reliable baseline for defense investment. The retirement traces to workforce attrition: CISA has lost roughly a third of its staff, and an internal split between the Cybersecurity and Integrated Operations Divisions over sustaining the underlying CSET tool, not a considered redesign. CISA itself frames it as consolidating overlapping legacy questionnaires into one standardized framework. Cybersecurity Dive broke this through direct agency confirmation and an anonymous internal source, with other outlets republishing that same reporting rather than adding independent sourcing.

3 sources

CISA scraps 6 free cybersecurity assessments for critical infrastructure operators - Cybersecurity Dive
CISA scraps 6 free cybersecurity assessments for critical infrastructure operators - Utility Dive
CISA retires six cybersecurity assessments for critical infrastructure amid rising threats, workforce pressures - Industrial Cyber