CISA memo sets Fiscal 2027 priorities for risk, partnerships and resilience
The Cybersecurity and Infrastructure Security Agency is directing its leaders to align Fiscal 2027 work around national cyber defense, the security of critical infrastructure and resilience across the country. An internal memo dated Nov. 2, 2026, from acting director Nick Andersen lays out operational priorities and the information agency personnel should collect and elevate to support them.
The guidance is intended to give staff a shared understanding of what CISA is focused on, what it needs to learn and how that information should inform decisions. Andersen told senior leaders to incorporate the priorities into routine work, share relevant developments promptly and exchange information across organizational boundaries.
Prioritizing infrastructure with broader consequences
The memo identifies six operational focus areas. A central theme is reducing risk to nationally significant infrastructure by directing partnerships and resources toward systems, assets and functions whose disruption could have the greatest consequences for the country. The framework also calls for government and industry partners to turn shared understanding of risks into coordinated steps to reduce them.
That emphasis places partnership and prioritization together: CISA’s support is to be directed with attention to the potential national impact of disruption. The memo highlights operators of critical infrastructure and developers of essential technology as important partners. It also points to the need to understand risky interdependencies among infrastructure sectors, rather than assessing each organization or system in isolation.
For enterprise security and risk leaders, this framing is relevant to how organizations document dependencies, communicate exposures and prepare for outages. CISA’s stated focus is on infrastructure and functions with substantial national consequences, but the memo does not identify particular companies or prescribe a specific assessment method. Its guidance instead sets agency-level priorities for directing attention and gathering information.
Information requirements guide collection and escalation
Six critical information requirements describe the broad questions CISA needs to answer to carry out its mission. They include identifying emerging or continuing threats, incidents and disruptions that could significantly affect public safety, economic security or other vital societal functions. They also cover preparedness gaps that could hinder companies or government agencies responding to major outages or disruptions.
Seven priority intelligence requirements provide a more focused set of topics for addressing those information needs. Among them are changes in the national risk environment; malicious actors’ targeting, particularly of operational technology; supply chains that are vital to critical infrastructure; and how emerging technologies and geopolitical developments may affect risk and adversary intent.
The memo also sets out 13 mission sustainment and resilience requirements. These address CISA’s ability to carry out its objectives, including staffing and workforce capabilities, technical tools for detecting adversary activity, and communications and information sharing with Sector Risk Management Agencies and infrastructure operators. The framework therefore covers both external threats and the agency’s own readiness to respond.
Breaking down internal silos
Andersen’s instructions include detailed questions for officials to consider under the intelligence requirements. The memo devotes five questions to changes in the national risk environment and 11 to adversaries’ plans to compromise critical networks. Managers are expected to ensure relevant information reaches the right parts of the agency and is raised quickly when it matters.
A stated purpose of the framework is to reduce differences in how CISA divisions collect information, assess risk and report findings to senior officials. A common set of priorities is meant to support more consistent work across organizational boundaries. That is a governance objective as well as an intelligence one: information gathered by separate teams can be harder to use when each group applies different assumptions or escalation practices.
The memo arrives as CISA faces workforce reductions and changes to its services and nationwide presence, according to the reported account of the agency’s circumstances. Andersen has served as acting director since February 2026. The agency is entering its third year without a Senate-confirmed director; President Donald Trump nominated a Palantir executive to lead CISA on Nov. 9, though the nomination may face Senate hurdles.
The document does not announce a new technical control or a specific requirement for private-sector organizations. Instead, it establishes internal direction for how CISA should set priorities, assess national risk, work with partners and maintain the capabilities needed to perform its mission. Its effectiveness will depend on whether the stated priorities translate into consistent information sharing and coordinated risk-reduction work across the agency and with infrastructure stakeholders.
