CISA Will No Longer Offer Six Free Cybersecurity Assessments After Budget Cuts

On August 25, 2026, the federal Cybersecurity and Infrastructure Security Agency (“CISA”), part of the U.S. Department of Homeland Security, announced that it would be eliminating six services it had previously offered to utilities and other critical infrastructure organizations for free: Cyber Resilience Reviews, Cyber Resilience Essentials Surveys, Ransomware Readiness Assessments, Incident Management Reviews, External Dependencies Management Assessments, and Cyber Infrastructure Surveys.  As a result of budget cutbacks, CISA has had to make many changes to its operations in the past few years, including mass layoffs in October 2025.

Critical infrastructure organizations may still be able to use older versions of CISA’s Cyber System Evaluation Tool (“CSET”) to walk through the now-cut assessments, but CISA employees will no longer be able to help organizations interpret the results.  Some experts have stated that CSET is an inadequate replacement for the six assessments.