The cyber agency said that surge has fueled “a moderate impact” in CI sectors meeting its cybersecurity performance goals.