Security1 publisher2 min readPublished
NSA sets a 30-day clock to fold its directorates into five mission centers
Gen. Joshua Rudd told the NSA workforce this month to rebuild around China, cyber, AI, combat support and global intelligence. Where the Cybersecurity Collaboration Center lands in that map is undecided.
The Watch · Security desk

What happened
- NSA is dissolving its directorates and rebuilding around five mission centers for China, cybersecurity, artificial intelligence, combat support and global intelligence, sources told Recorded Future News.
- Army Gen. Joshua Rudd, who runs both NSA and U.S. Cyber Command, briefed the workforce earlier this month and started a 30-day clock to put the new structure in place.
- Tailored Access Operations is expected to move under global intelligence. Newer bodies including the Cybersecurity Collaboration Center have not been assigned to any of the five centers.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure Private-sector defenders who route indicators and requests through NSA collaboration programs are dealing with an office that has not yet been placed in the new structure, and that holds for as long as the transition runs.
- constraint Leadership has already accepted internal breakage as the price of speed, so continuity of a named point of contact is not something an outside partner can assume through January.
- precedent A 30-day clock on an agency-wide redraw sets a pace that other intelligence-community components can now be told to match.
The five names are China, cybersecurity, artificial intelligence, combat support and global intelligence [1]. The people who described the plan to Recorded Future News, all of whom spoke anonymously, could not say which of them absorbs the Cybersecurity Collaboration Center [1][5]. Tailored Access Operations, the hacking unit built in the 1990s and recently resurrected, is expected to sit under global intelligence [6].
Rudd started a 30-day clock when he briefed the workforce earlier this month [3]. A former NSA official said the five centers are expected to reach full operational capability, the military term for being able to carry out assigned missions, by January [7]. The 30 days moves reporting lines, and January is the bar for each center being able to run its mission [18].
Both a current and a former agency official said Rudd and Deputy Director Tim Kosiba know the rapid realignment will "break things" in the agency's often slow-moving bureaucracy and will have to adjust on the fly [8]. For an outside partner, that breakage is administrative: an unnamed center chief, and a report that used to go to a directorate that no longer exists. Some chiefs have been picked, including the head of AI, and could be announced internally as soon as Monday, according to the same sources [4].
How the reorganization changes NSA's relationship with Cyber Command is also unresolved. The two share resources and a campus at Fort Meade, Maryland, and Rudd runs both [9][3].
This is the third restructuring effort at Fort Meade in roughly ten years [17]. NSA21, about a decade ago, tried to meld the offensive and defensive organizations, and current and former officials consider it a failure that created more bureaucratic confusion [10]. EVO25, begun around the start of the second Trump administration, would have consolidated the agency's offices and was seen as a way to avoid a scheme imposed by the U.S. DOGE Service; it was abandoned [11].
At his second confirmation hearing in January, before the Senate Intelligence Committee, Rudd said his "first priority is speed" [12]. Rudd said scale came second, then innovation, then integration, and that the agency had to move as fast as it could to make sure it had the right technologies and the right capabilities and could generate multiple options [13]. He was confirmed to the dual-hat role in March [14]. Multiple sources said Kosiba and Executive Director Darren Turner share his aim of getting NSA intelligence to military customers faster [15]. The agency did not respond to a request for comment [16]. The Washington Post first reported the rearrangement [2].
What to watch
- Which of the five centers is assigned the Cybersecurity Collaboration Center, and whether its staff and outside contacts move with it.
- The internal naming of the five center chiefs, which sources said could come as soon as Monday.
- Any redefinition of the dual-hat NSA and Cyber Command arrangement as the centers approach full operational capability.