CISA Framework Sets Cyber and Infrastructure Priorities, With Guidance to Follow

The Cybersecurity and Infrastructure Security Agency (CISA) circulated an internal framework on November 5, 2026, to help senior officials assess major cybersecurity and infrastructure threats and make timely decisions. As reported by Nextgov/FCW, Acting Director Nick Andersen sent an unclassified email marked “For Official Use Only” to agency staff describing the framework’s purpose: to help leaders “cut through the noise” and distinguish useful information from what is mission-critical. CISA plans to issue implementation guidance to its divisions in the coming months. The framework is an internal planning development, not an announced acquisition or solicitation.

The framework identifies six operational focus areas, including assessing national risk, defending against major cyber threats, preparing for serious incidents, helping critical infrastructure withstand disruptions, and coordinating with partners. Its critical information requirements describe what senior officials need to know to make decisions, covering shifts in risk, serious threats and incidents, effects on nationally significant infrastructure, national preparedness, coordination, and CISA’s capacity to carry out its mission. The accompanying priority intelligence requirements identify questions intelligence work can help answer, including where and how hackers are operating against U.S. and allied computer networks and industrial systems.

For contractors, these priorities point to mission areas that may shape future CISA requirements: threat intelligence and analysis, incident preparedness, critical-infrastructure resilience, cyber and physical risk management, and operational capacity. The framework also references supply chains and production capabilities as areas relevant to risk assessment. Companies supporting these missions can review their existing capabilities and positioning against the identified priorities, but should not treat the framework as a near-term bid signal. The source explicitly reports that CISA has not announced procurement timelines or requirements.

The approach draws on terminology used in military and intelligence planning. Priority intelligence requirements focus collection and analysis on questions leaders consider important, while commander’s critical information requirements identify information needed for timely decisions. The broad priorities also echo CISA’s CISA 2030 strategy, released the previous month, which calls for using threat intelligence and analyzing the potential consequences of disruptions to guide assistance and investment. Andersen characterized the work as an initial step: “Publishing our initial CIRs is the starting point of a deliberate, requirements-driven approach to our mission.” The next practical signal for industry will be the forthcoming divisional guidance, which could clarify how broad priorities translate into operational needs.

• CISA circulated the internal framework on November 5, 2026; the report was published November 10.
• The framework is intended to help senior leaders prioritize risk, identify decision-critical information, and coordinate preparedness and response.
• Six operational focus areas include national risk assessment, major cyber threats, serious-incident readiness, critical-infrastructure resilience, and partner coordination.
• Critical information requirements include changes in risk, significant incidents, infrastructure impacts, national preparedness, coordination, and agency mission capacity.
• Priority intelligence requirements address cyber and physical risks, threat warning signs, hacker activity against U.S. and allied networks and industrial systems, supply chains, and production capabilities.
• The framework echoes CISA 2030, which links threat intelligence and disruption analysis to decisions about assistance and investment.
• CISA expects to issue divisional implementation guidance in the coming months; the source provides no procurement schedule or specific requirements.
• Contractors in intelligence, incident preparedness, infrastructure resilience, and operational support can assess alignment with these priorities without assuming an active solicitation.