Bob Kolasky, head of CISA's National Risk Management Center, leaving agency

Director Jen Easterly said Kolasky has been an "outstanding leader at CISA."

Bob Kolasky, head of the National Risk Management Center at CISA, announced Tuesday that he is leaving the agency.

Kolasky’s work with the NRMC since its formation in 2018 has put him in the middle of the federal effort to help critical infrastructure companies assess their cyber risk. He’s also been active in a lot of other agency business.

He co-chairs the Information and Communications Technology Supply Chain Risk Management Task Force, leads CISA’s work on secure 5G network development, chairs the High-Level Risk Forum for the international Organisation for Economic Co-operation and Development and serves on the executive Committee for the Election Infrastructure Government Coordinating Council.

Kolasky hasn’t announced his plans after leaving the center, nor has CISA named a successor.

During his 15 years of government service, CISA Director Jen Easterly said, “Bob worked tirelessly to expand collaboration across state, local, tribal, and territorial governments and the private sector to reduce cyber and physical threats to critical infrastructure, ensure our nation’s resilience, and protect American lives.”

Kolasky’s departure comes days after POLITICO reported that Mona Harrington, the departing executive director of the Election Assistance Commission, was joining the NRMC as deputy assistant director.

The NRMC has recently been involved in a project of high interest among CISA leadership and on Capitol Hill. Easterly said she tasked it with developing approaches to identifying entities that are the “systemically important, and we’re doing it based on economic centrality, network centrality and logical dominance in the national critical functions.” Pending legislation dubbed it “systemically important critical infrastructure,” something CISA has instead been calling “primary systemically important entities.”

Easterly said Kolasky has been an “outstanding leader at CISA,” and praised him further on Twitter.

CISA is rethinking how it prioritizes risks and vulnerabilities for feds, private sector

Acting director Nick Andersen said a binding operational directive is en route for agencies, and that more specific discussions need to happen with critical infrastructure owners.

Trump pauses on grants, aid leaves federal cyber programs in state of confusion

Biden cyber executive order gets mostly plaudits, but its fate is uncertain

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure