CISA releases its first Roadmap for Artificial Intelligence

CISA published its first Roadmap for Artificial Intelligence on November 14, 2023, outlining how the agency will manage AI risks and opportunities across cybersecurity and critical infrastructure. The document was released the same day CISA announced it, dated November 14, 2023.

What it is

The roadmap is a planning document, not a binding rule, that guides CISA's AI-related efforts and aligns them with the wider federal government AI strategy. It incorporates CISA-led actions directed by Executive Order 14110 on safe, secure and trustworthy AI, issued the previous month.

What it requires

CISA structured the roadmap around five lines of effort: responsibly using AI to support its own mission, assuring AI systems, protecting critical infrastructure from malicious use of AI, collaborating with interagency and international partners, and expanding AI expertise in its workforce. Under the critical infrastructure line of effort, CISA committed to establishing JCDC.AI to focus collaboration on threats, vulnerabilities and mitigations related to AI systems. The roadmap also states that CISA plans to incorporate AI security into its Secure by Design program.

What security leaders should do

Security leaders overseeing critical infrastructure should track CISA's assurance work under Line of Effort 2, since it includes best practices and guidance for secure and resilient AI development, including red-teaming recommendations for generative AI. Organizations in critical infrastructure sectors should also monitor JCDC.AI outputs, since CISA indicated it would work with that group on an AI incident response playbook. Because the roadmap treats AI systems as IT systems subject to fundamental security practices, teams should apply existing secure-by-design and risk-management processes to AI deployments rather than treating AI as an entirely separate discipline.