CISA offers services to public and private providers of infrastructure deemed critical that include pen testing, but they don't have the resources to offer it to all who want it.