"cut through the noise." — Acting Director Nick Andersen
Nick Andersen's Nov. 5 guidance to CISA staff
In an unclassified Nov. 5 email marked "For Official Use Only," acting Director Nick Andersen circulated an internal framework intended to help senior officials at the Cybersecurity and Infrastructure Security Agency assess cybersecurity and infrastructure risks and act before crises erupt. Andersen described the guidance as an effort to help leaders "cut through the noise," and said the agency will publish follow-on materials to help divisions adopt the priorities.
Six operational focus areas laid out for rapid response
The internal framework sets out six "operational focus areas" designed to orient CISA leadership. The document, as summarized in the guidance, includes focus areas for assessing national risk, warding off major cyber threats, preparing for serious incidents, helping critical infrastructure withstand disruptions, and coordinating with partners. The framework is intended to give senior officials a structured set of priorities to guide decisions across CISA's missions.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildCritical information requirements and priority intelligence requirements
Andersen's guidance also introduces "critical information requirements" (CIRs) and a separate set of "priority intelligence requirements" (PIRs). The CIRs identify the specific facts senior officials need to make timely decisions: major changes in risk, serious threats and incidents, impacts on nationally significant infrastructure, how prepared the country is for disruptions, the degree of coordination across efforts, and whether CISA has the capacity to carry out its mission.
The PIRs direct intelligence collection and analysis to questions such as how changing conditions affect critical infrastructure, what warning signs could indicate serious risks, and where and how hackers are operating against U.S. and allied computer networks and industrial systems. The PIRs also ask how cyber and physical risks are being managed, including supply chains and production capabilities. The guidance uses terminology familiar in military and intelligence planning; the document notes longstanding uses for PIRs and commander’s critical information requirements (CCIRs) in focusing collection and decision-making.
How the guidance ties to CISA 2030 strategy
The new internal framework echoes priorities in CISA's CISA 2030 strategy, released last month. That strategy called for using threat intelligence and analyzing the potential consequences of disruptions to guide where assistance and investment should go. It also emphasized protecting industrial technology, improving threat alerts, and coordinating more closely with intelligence agencies and infrastructure operators—objectives reflected in the CIRs and PIRs Andersen published.
Andersen described the published CIRs as "the starting point of a deliberate, requirements-driven approach to our mission," and said the agency will roll out additional guidance in the coming months to help divisions across the cyberdefense shop adopt the priorities.
What this means for Michael LoSapio, CISA's workforce, and national preparedness
- Michael LoSapio: Andersen issued the guidance less than a week before President Donald Trump nominated Michael LoSapio, Palantir’s chief information security officer, to lead CISA. If confirmed, LoSapio would inherit an agency in the midst of implementing the new requirements and rolling out further guidance.
- CISA workforce: The guidance arrives while the agency is rebuilding after cuts over the last two years that have reduced its workforce by roughly a third, a constraint that factors into the CIRs' focus on whether CISA has the capacity to carry out its mission.
- National preparedness: The CIRs explicitly track how prepared the country is for serious incidents and how coordinated efforts are, signaling a shift toward decision-making tied to measurable indicators of national readiness and cross-sector coordination.
The document represents an internal effort to align operational priorities, intelligence collection, and executive decision-making inside CISA. Two concrete next steps are already on the calendar in the guidance: the agency will roll out additional, operational guidance to its divisions in the coming months, and presidentially nominated leadership awaits Senate confirmation. How quickly those internal priorities translate into measurable changes on the ground will hinge on the rollout schedule and the agency's available capacity.
