CyberzSOC

CISA Analysis: Fiscal Year 2022 Risk and Vulnerability Assessments The Cybersecurity and Infrastructure Security Agency (CISA) conducts Risk and Vulnerability Assessments (RVAs) for the federal civilian executive branch (FCEB); high priority private and public sector critical infrastructure operators; and select state, local, tribal, and territorial (SLTT) stakeholders. Concurrently, the United States Coast Guard (USCG) conducts RVAs on maritime critical infrastructure operated by SLTT and private-sector organizations. The RVA is intended to assess the entity’s network capabilities and network defenses against potential threats. In Fiscal Year 2022 (FY22), CISA and USCG conducted 121 RVAs across multiple critical infrastructure sectors.1 Each RVA maps the results to the MITRE ATT&CK® framework, which includes 14 tactics that cyber threat actors use to obtain and maintain unauthorized access to a network or system. The goal of the RVA analysis is to develop effective strategies that positively impact the security posture of FCEB, critical infrastructure, maritime, and SLTT stakeholders. During each RVA, CISA and USCG collect data through remote and onsite actions.