Summary
- Nick Andersen has served as acting CISA director since February, but faces a 210-day statutory limit on that role with no permanent nominee yet named.
- Sean Plankey withdrew his nomination in April; a replacement flagged by DHS Secretary Mullin in June has not materialised four months on.
- The administration may attempt to extend Andersen’s tenure by shifting his title to ‘senior official performing the duties of’ director, sidestepping the time limit.
- Bipartisan congressional support exists for Andersen, with both the House Homeland Security Committee chair and ranking member publicly backing his continued leadership.
- Without Senate confirmation, CISA’s ability to advocate for its priorities within the interagency process is weakened, according to subject matter experts.
The clock problem
Nick Andersen has led the Cybersecurity and Infrastructure Security Agency in an acting capacity since February, but that arrangement carries a hard ceiling. Under applicable law, acting officials face a 210-day limit in the role. With no permanent nominee confirmed — or even publicly named — the administration is approaching a governance decision it cannot defer indefinitely.
A nomination pipeline that stalled
Sean Plankey was the last confirmed nominee for the Senate-confirmed CISA director position, but he withdrew in April. In June, DHS Secretary Markwayne Mullin indicated a likely replacement had met with the president and an announcement was imminent. Four months later, no candidate has been put forward. The White House did not respond to media inquiries on the matter, and DHS declined to elaborate beyond expressing support for Andersen’s work.
Options on the table
Mark Montgomery, senior director of the Foundation for Defense of Democracies’ Center on Cyber and Technology Innovation, explained that nominating a candidate would pause Andersen’s 210-day clock, effectively keeping him in place while a nominee moves through the Senate process. However, Montgomery suggested this path may be blocked by the president’s well-documented hostility toward the agency. “My gut reaction is that there’s just no appetite at the White House to say the four-letter ‘CISA’ to the president,” Montgomery said. A separate mechanism under consideration, according to multiple sources, is re-titling Andersen as “senior official performing the duties of” CISA director — a label that could extend his tenure without requiring a nomination.
Strong support, limited leverage
Andersen appears to have broad backing from the people who work with him. House Homeland Security Committee Chairman Andrew Garbarino described Andersen as doing “an excellent job” and said he would “gladly support his nomination.” The committee’s ranking Democrat, Bennie Thompson, was similarly supportive, warning that “any unnecessary changes to CISA’s leadership could once again destabilize CISA, which would make America less safe.” An industry source told CyberScoop that support for Andersen was widespread, calling his lack of a formal nomination a “missed opportunity” given the limited legislative calendar remaining in this Congress.
Agency trajectory under Andersen
Former DHS chief information officer John Zangardi offered a direct assessment of the agency’s direction. “The organization is actually getting much better under Nick,” he said, noting a marked improvement in staff morale compared to conditions a year ago. CISA has also continued forward-looking planning under Andersen’s tenure, most recently publishing a strategy intended to guide the agency through 2030. Montgomery observed that Andersen “strikes me as someone who knows he’s got more than a month left in his job” — a signal, he said, that Andersen is planning several months ahead, which he described as notable for the current administration.
The cost of an unconfirmed director
Beyond the symbolic value of Senate confirmation, the practical consequences matter for CISA’s operational effectiveness. Montgomery noted that a Senate-confirmed director gives the agency stronger standing in interagency debates and at the White House when competing for resources and policy attention. CISA has already absorbed significant budget and personnel cuts. Without a confirmed leader, the agency’s ability to push back in those forums is constrained, regardless of how capable the acting director may be.
Why it matters
For CISOs in critical infrastructure sectors, CISA is a primary federal partner for threat intelligence sharing, incident response coordination, and vulnerability guidance. Leadership instability — or ambiguity about who holds authority — can slow the agency’s responsiveness and reduce the weight it carries in policy discussions that directly affect sector security posture. An agency operating without a Senate-confirmed director is also more susceptible to budget and mandate pressures from within the administration. CISOs who depend on CISA engagement should monitor this situation and maintain direct relationships with agency staff rather than assuming continuity at the top.
What to do now
- Maintain and strengthen direct working relationships with CISA regional and sector-specific staff, rather than relying solely on leadership-level engagement that may be subject to change.
- Track any changes to Andersen’s title or formal authority, as these may affect the agency’s standing in interagency processes that influence critical infrastructure policy.
- Review your organisation’s existing CISA partnerships and information-sharing agreements to ensure they remain active and do not depend on assumptions about stable leadership continuity.
- Engage with relevant industry associations to ensure the private sector’s preference for CISA stability is communicated clearly to congressional contacts, as bipartisan support for Andersen’s nomination appears to exist on Capitol Hill.
