No presidential nominee for CISA director as acting director’s limit nears

Nick Andersen has served as acting director of CISA since February 2026, after leading the agency’s Cybersecurity Division, and no presidential nominee for the Senate-confirmed role is in sight as of Nov. 2, 2026, CyberScoop reported.

A 210-day cap applies to Andersen’s service as acting director. Selecting a nominee would pause that limit, according to Mark Montgomery of the Foundation for Defense of Democracies on Nov. 2, 2026. Sources told CyberScoop on Nov. 2, 2026 that the administration may keep Andersen by shifting his title to a senior official performing the duties of the role.

Montgomery said on Nov. 2, 2026 that there is no appetite at the White House to nominate a CISA director because of past animosity toward the agency. “my gut reaction is that there’s just no appetite at the White House to say the four-letter ‘CISA’ to the president”. The White House did not respond to inquiries about Andersen on Nov. 2, 2026.

Sean Plankey ended his nomination bid for the Senate-confirmed role in April 2026. Markwayne Mullin said in June 2026 that a probable successor had met with the president and would be named soon. On Nov. 2, 2026, the administration was seeking a candidate with a high pre-existing profile, such as a big-name tech company role, when replacing Plankey. No nominee emerged four months after Mullin’s June statement.

On Nov. 2, 2026, a DHS spokesperson said they proudly support the work Andersen has done. House Homeland Security Committee Chair Andrew Garbarino supports Andersen’s nomination and praised his leadership. Ranking member Bennie Thompson said on Nov. 2, 2026 that Andersen brought stability following a year of chaos and poor leadership at CISA. Thompson said unnecessary leadership changes could destabilize the agency.

John Zangardi said on Nov. 2, 2026 that morale has gone back up under Andersen and that he is important for continuity. Montgomery said on Nov. 2, 2026 that a Senate-confirmed nominee would help CISA compete for priorities inside the interagency process and the White House. He also said on Nov. 2, 2026 that Andersen has been making longer-term plans and thinking three to six months out. He also said on Nov. 2, 2026 that other top agency positions have been confirmed by the Senate under Mullin.

CISA released a strategy meant to carry the agency through 2030 in October 2026. The plan gives CISA 180 days to issue an implementation plan and one year to report progress. CISA began in 2018 under DHS as the nation’s cyber defense agency and critical infrastructure coordinator.

Mullin assigned CISA to develop the Election Infrastructure Security Plan in July 2026. CISA supported partners ahead of the 2026 elections on Oct. 12, 2026. The agency offers no-cost services to state and local election officials and outlines threats to voting systems. As of Oct. 27, 2026, malicious cyber criminals see election officials, candidates, and political organizations as attractive targets because they can access voter registration data, current government officials, and sensitive campaign information.

On Aug. 6, 2026, Andersen said CISA is working with the FBI on water sector cyberattacks affecting at least 12 states. Minnesota officials said more than 30 community water systems were targeted in late July 2026. Andersen said, “Get your operational technology off the internet, set a password”.

About a week before Aug. 6, 2026, CISA warned that hackers increasingly target internet-connected controllers at water and wastewater utilities. Around 12 states reported similar water sector activity in recent days before Aug. 6, 2026. Attackers changed passwords and settings, locked out operators, and caused water pressure issues, boil-water notices, and extended manual operation.

CISA is not attempting to publicly attribute the water sector hacks. U.S. officials suspect Iran-linked hackers are behind the attacks. On Aug. 6, 2026, a CISA notice said the Minnesota activity resembled an earlier Iran-affiliated campaign but lacked direct evidence tying the latest incidents to Tehran.

On Oct. 13, 2026, CISA was developing a CI Fortify tabletop exercise program to help critical infrastructure operators assess recovery from cyberattacks. The agency launched CI Fortify in May 2026. The initiative began as a Five Eyes conversation for international resilience and recovery planning. CI Fortify aims to keep essential services running or restore them quickly after cyberattacks or natural disasters, and Andersen said, “Being able to have that measurable, demonstrable level of accountability for continuous delivery of essential services”.