CISA
What is CISA?
The Cybersecurity and Infrastructure Security Agency, a US government agency responsible for protecting critical infrastructure from cyber and physical threats.
Terms that appear alongside cisa
Each of these is named in at least one of the same controls as cisa. The number is how many controls name both.
- cybersecurity 44 shared controls
- nist 35 shared controls
- vulnerability 23 shared controls
- incident response 21 shared controls
- threat intelligence 17 shared controls
- incident reporting 16 shared controls
- cyber incident 15 shared controls
- integrity 14 shared controls
Frameworks that govern cisa
What the standards actually require on cisa
Requirements naming cisa across 6 standards, quoted from the control text.
If CISA has reason to believe a covered entity experienced a covered cyber incident or made a ransom payment but failed to report, it may request additional information; the entity should respond to confirm whether a reportable event occurred.
CIRCIA-2244b · Response to a CISA Request for Information →ICT service providers must also report directly to CISA whenever they report an incident under 2(f)(i) to a Federal Civilian Executive Branch agency, and CISA collects and manages those reports centrally;
us-executive-order-14028-improving-the-nations-cybersecurity::2(f)(ii) · Sec. 2(f)(ii) Also report to CISA →Within 180 days of CISA releasing the technical controls developed by its EDR working groups, the heads of FCEB agencies enroll endpoints that use an EDR solution covered by those controls in the CISA Persistent Access Capability program.
us-executive-order-14144-strengthening-and-promoting-innovation-in-the-nations-cybersecurity::3(c)(v) · Sec. 3(c)(v) (now 3(a)(v)) Enroll EDR endpoints in CISA's Persistent Access Capability →A secure SDLC is not enough if the manufacturer's own enterprise and build environments can be used to tamper with a product during development, an attack that has already harmed customers;
secure-by-design-a-guide-for-manufacturers-cisa::P1-PD2 · Document conformance to the CISA CPGs or an equivalent →Reports must be made as soon as practicable and no later than 72 hours after the owner/operator identifies a cybersecurity incident (01F lengthened the window from 24 hours;
tsa-pipeline-cybersecurity-directives::SD01-II.C.3 · SD01 II.C.3 and 4 Report within 72 hours through CISA Central →An information system audit of internal systems and processes must be in place and conducted at least once every two years by CISA-certified external auditors;
india-account-aggregator-framework-rbi::30(6) · Para 30(6): biennial IS audit by CISA-certified external auditors, report to RBI within a month →Questions people ask about cisa
What is CISA?
Why is CISA important for compliance?
Which compliance frameworks address CISA?
Where can I learn more about CISA?
See how CISA applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.