Project 2025 Tracker / What’s done, what’s next

5. Department of Homeland Security · Minor

Have CISA build cyber intelligence products with NSA and Cyber Command

Done

161 5. Department of Homeland Security

“The Cybersecurity and Infrastructure Security Agency, which is not a member of the IC, should create cyber intelligence products in a collaborative fashion with the National Security Agency and U.S. Cyber Command.”

What has happened

  1. Done

    The practice continues. Advisory AA26-231A of 2026-08-19, on an active threat to Siemens S7 Series programmable logic controllers, is issued by NSA, CISA, the FBI, the Department of Energy and the EPA as “the authoring agencies” and carries a threat assessment, not just mitigations. (This event previously read `partial` on the ground that "U.S. Cyber Command is not named on any CISA product found in the window". That was an artefact of the 30-item RSS feed the earlier pass had to use; the full advisories index, filtered by co-sealer, shows CNMF on AA26-097A four months earlier.)

  2. Done

    Both partners the Quote names are on one product, inside the window. Joint Cybersecurity Advisory AA26-097A, *Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure*, names its authors in terms: "The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), Environmental Protection Agency (EPA), Department of Energy (DOE), **United States Cyber Command – Cyber National Mission Force (CNMF)**, and Department of the Treasury (Treasury) (hereafter referred to as the 'authoring agencies') are urgently warning U.S. organizations of ongoing cyber exploitation of internet-connected operational technology devices." It is a cyber *intelligence* product and not merely guidance: it attributes the activity to Iranian-affiliated advanced actors, sets out their tactics, techniques and procedures, and ships machine-readable indicators of compromise as STIX XML and JSON, updated 2026-07-22. CISA creating cyber intelligence products collaboratively with NSA and U.S. Cyber Command is what the Quote asks for, and this is it — `done`.

Research log

What was searched, and what didn’t count as evidence

Research notes

Read in full at https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-231a; the authoring-agency line is quoted in the note.

  • CISA’s advisory feed (https://www.cisa.gov/cybersecurity-advisories/all.xml, 30 most recent items, read 2026-08-28) was searched for “National Security Agency”, “Cyber National Mission Force”, “U.S. Cyber Command” and “USCYBERCOM”: AA26-231A was the only joint product the feed reached, which is a floor rather than a census.

  • Reviewed 2026-09-06; moved from partial to done. The full index does not need paging by hand: CISA’s advisory index (cisa.gov/news-events/cybersecurity-advisories) can be filtered by its Co-Sealers and Partners facet, so the census the feed could not give is one filtered page. Filtering on United States Cyber Command returns exactly one advisory, AA23-250A of 2023-09-07, before the window — which is how a census can still mislead, because U.S. Cyber Command co-seals through its subordinate command. Filtering on the Cyber National Mission Force returns two, and one of them, AA26-097A, is inside the window and names “United States Cyber Command – Cyber National Mission Force” in its own authoring-agency line. Filtering on the National Security Agency shows the NSA half is routine, not exceptional: six co-sealed advisories in the window (2025-08-27, 2025-09-03, 2025-10-30, 2025-12-03, 2026-04-07, 2026-08-19). Search the subordinate command, not only the combatant command: the name the Quote uses for a thing is usually not the name on the instrument.

  • Not flagged Already true. Joint CISA-NSA advisories long predate 2025-01-20, so the practice was already in place; but that flag requires that nothing happened inside the window, and a joint product was issued inside it. The Status therefore describes the action, and this note records that it is continuation rather than a new departure.

  • CISA’s own site search could not be queried, which is why the feed was used.

Action
create
Object
CISA cyber intelligence products
ID
425