CISA Replaces Decades-Old Partnership Framework with ANCHOR-CI to Modernize Critical Infrastructure Security
CISA has launched ANCHOR-CI, a new framework designed to enhance government-industry collaboration on critical infrastructure security, replacing the 20-year-old CIPAC model.
The Cybersecurity and Infrastructure Security Agency (CISA) has unveiled ANCHOR-CI, a significant overhaul of its framework for collaborating with private industry on critical infrastructure protection. Published in the Federal Register on July 1, the "Establishment of the Alliance of National Councils for Homeland Operational Resilience – Critical Infrastructure (ANCHOR-CI)" notice details a new structure for CISA to form councils that will allow private partners to advise the government on cybersecurity and broader critical infrastructure resilience issues. This initiative replaces the Critical Infrastructure Partnership Advisory Council (CIPAC), which has served as the primary mechanism for government-industry collaboration for the past two decades.
The dissolution of CIPAC in March of the previous year by former Homeland Security Secretary Kristi Noem drew immediate criticism from Congress and private sector stakeholders. The termination of CIPAC effectively dismantled the 16 sector-specific coordinating councils (SCCs) that facilitated dialogue between private partners and federal agencies. Without CIPAC's legal exemptions, these SCCs could no longer convene private meetings to provide consensus-based advice to their government counterparts without triggering complex legal requirements under the Federal Advisory Committee Act (FACA).
While other government entities like CISA's Joint Cyber Defense Collaborative, the Department of Energy's Energy Threat Analysis Center, and the NSA's Cybersecurity Collaboration Center continued to operate, none fully replicated the steady forum that SCCs provided for hashing out critical infrastructure protection strategies. The article acknowledges that the SCC model was not without its flaws, citing stagnant membership, variable recommendation quality, and barriers to entry for new members. However, the core limitation was its inherently siloed, sector-specific approach, which was established in an era when risks were viewed through distinct lenses such as energy, transportation, or water.
Modern cyber threats, however, transcend these traditional boundaries. A vulnerability in a cloud service provider or an industrial software platform can simultaneously impact diverse sectors like healthcare, manufacturing, finance, and utilities. ANCHOR-CI is designed to address this interdependency by moving beyond the sector-specific model. It introduces four distinct types of councils to foster more dynamic and cross-cutting collaboration.
These new council structures include Critical Infrastructure Sector Councils, which largely mirror the former SCCs but with direct approval and removal authority over members vested in the CISA director. More significantly, ANCHOR-CI establishes Cross-Sector Councils tasked with addressing "current and emerging threats, interdependencies, or other issues impacting multiple critical infrastructure sectors or industries." Potential examples include councils focused on countering unmanned aerial systems (UAS), mitigating AI-related threats, or strengthening supply chain resilience.
Further enhancing the framework are Critical Infrastructure Industry Councils, designed for issues that span sectors but don't fit neatly into a single defined sector. The article suggests that following incidents like the Volt Typhoon campaign, an Operational Technology council could be formed with original equipment manufacturers, software providers, and infrastructure owners to counter threats effectively. Additionally, Regional Coordinating Councils are planned to help state and local governments address geographically specific risks, though their precise implementation remains to be detailed.
ANCHOR-CI inherits the FACA exemption authority previously granted to CIPAC, allowing for private meetings, rapid convening, and selection of members based on expertise, while still being subject to Freedom of Information Act requests. The success of ANCHOR-CI will ultimately depend on CISA's execution. If managed with transparency and strategic foresight, this new framework has the potential to represent the most significant advancement in public-private cybersecurity collaboration in twenty years.