CISA

1. 2026-10-21 Info
   CISA, FBI and partners release advisory on SafePay ransomware actors targeting critical infrastructure

   CISA, FBI, U.S. Secret Service and international partners released a joint advisory warning of SafePay ransomware actors, identified as one of the most active ransomware groups …

   Other Enforcement

2. 2026-09-23 Low
   CISA releases CVE Program Quality Era Framework to advance vulnerability identification standards

   CISA released a whitepaper, CVE Program: Establishing a Quality Era Framework, detailing its strategy to mature the Common Vulnerabilities and Exposures (CVE) Program—the global standard for …

   Guidance

3. 2026-09-16 Low
   CISA releases guidance on implementing cyber decoy strategies for critical infrastructure

   CISA released new guidance titled "Using Cyber Decoys to Strengthen Detection and Response" to help critical infrastructure owners and operators implement cyber decoy systems that detect …

   New document

4. 2026-09-15 Medium
   CISA and NIST release guidelines to protect federal cloud identity systems from token theft, forgery…

   CISA and NIST released Interagency Report (IR) 8587 providing comprehensive guidelines for federal agencies and cloud service providers to defend identity tokens and assertions used in …

   New document Action required

5. 2026-09-09 Medium
   CISA releases updated Insider Threat Mitigation Guide addressing hybrid work and AI risks

   CISA released an updated version of its Insider Threat Mitigation Guide, originally published in 2020, to address evolving threats in the modern operational landscape. The updated …

   New version Action required

6. 2026-08-20 Critical
   CISA publishes Logging Reference Architecture to guide federal agencies on enterprise logging standards

   CISA has published the Logging Reference Architecture, an outcome-driven guide developed with OMB and the CISO Council to help federal civilian executive branch (FCEB) agencies establish …

   New document Deadline 2026-11-18 Action required

7. 2026-08-12 Medium
   CISA releases K-12 Cybersecurity Foundations Resource Package with guides and video series

   CISA released the K-12 Cybersecurity Foundations Resource Package on August 12, 2026, providing guides, videos, and supplemental materials to help K-12 schools and districts prevent and …

   New document Action required

That is the last 90 days. Sign in to read further back.

1. 2026-11-18 in 9 days CISA Logging Reference Architecture: outcome-driven guidance for FCEB agencies to build Agency Logging Plans under OMB M-26-14
2. 2026-06-10 BOD 26-04 issued; BOD 19-02 and BOD 22-01 revoked. Within 60 days of issuance agencies must update vulnerability management procedures (Phase II); within 180 days of issuance they must remediate within the Table 1 timelines and tag all externally reachable assets (Phase III)
3. 2026-02-25 Emergency Directive ED 26-03: Mitigate Vulnerabilities in Cisco SD-WAN Systems
4. 2026-02-05 BOD 26-02 issued. Agencies must decommission devices on CISA's EOS Edge Device List within 12 months of issuance, all identified end-of-support edge devices within 18 months, and continuously discover edge devices within 24 months
5. 2026-01-08 CISA retires ten Emergency Directives issued between 2019 and 2024

1. 2026-06-10
   BOD 26-04: Prioritizing Security Updates Based on Risk AmendmentCurrent text

   Consolidates vulnerability remediation rules and revokes BOD 19-02 and BOD 22-01. source

   More

   • Deadlines now depend on whether an asset is publicly exposed, whether the CVE is in the Known Exploited Vulnerabilities (KEV) catalog, whether exploitation can be automated, and the technical impact.
   • The most urgent cases require remediation within three days plus a forensic triage.
   • The KEV catalog itself continues.
2. 2026-02-05
   BOD 26-02: Mitigating Risk From End-of-Support Edge Devices Amendment

   Requires agencies to update or remove end-of-support edge devices: inventory devices on CISA's EOS Edge Device List within three months, decommission listed devices within 12 months and all EOS edge devices within 18 months. source

   More

   • Within 24 months agencies need a continuous discovery process.
3. 2024-12-17
   BOD 25-01: Implementing Secure Practices for Cloud Services Amendment

   Requires agencies to inventory in-scope cloud tenants, deploy CISA's SCuBA assessment tools with continuous reporting, and implement mandatory SCuBA secure configuration baselines. source

4. 2023-06-13
   BOD 23-02: Mitigating the Risk from Internet-Exposed Management Interfaces Amendment source

   Not confirmed by an official source yet.

5. 2022-10-03
   BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks Amendment source

   Not confirmed by an official source yet.

Binding Operational Directives and Emergency Directives are compulsory for Federal Civilian Executive Branch agencies; CISA says organizations should use the KEV catalog in their vulnerability prioritization.

Federal civilian agencies

Binding Operational Directives and Emergency Directives are compulsory for Federal Civilian Executive Branch agencies. source source

Not covered

They do not cover national security systems or certain systems operated by the Department of War or the Intelligence Community. source

Everyone else

CISA says organizations should use the KEV catalog as an input to their vulnerability management prioritization framework. source

Agencies report to CISA as each directive specifies.

BOD 26-04

Agencies report to CISA as each directive specifies: under BOD 26-04, automated KEV status reporting through the CDM dashboard (or manual reports every two weeks) and quarterly attestation of public IP addresses and domains. source

BOD 26-02

Under BOD 26-02, agencies submit inventories and decommission reports on CISA templates. source

Agencies are required by statute to comply, and CISA reports cross-agency status.

Statutory duty

Federal agencies are required to comply with these directives under 44 U.S.C. § 3554(a)(1)(B)(ii). source source

Oversight

CISA tracks progress and reports cross-agency status to the Secretary of Homeland Security, the Director of OMB and the National Cyber Director. source

1. Law text CISA Cybersecurity Directives (current BODs and EDs)
2. Law text BOD 26-04: Prioritizing Security Updates Based on Risk
3. Guidance BOD 26-04: Implementation Guidance
4. Guidance Known Exploited Vulnerabilities Catalog
5. Guidance Secure by Design

1. CISA CPG

   The Cross-Sector CPGs are CISA's voluntary baseline for critical infrastructure; the directives bind federal civilian agencies.

2. TIC 3.0

   TIC 3.0 is CISA's network architecture guidance for agencies under OMB M-19-26; BODs are specific mandatory actions with deadlines.

3. CISA SSDAF

   The secure software attestation form is CISA's common form for software producers; directives apply to agencies, not vendors.

4. NIST SP 800-53

   SP 800-53 is the federal control catalog; CISA directives order specific actions, such as patching deadlines, on top of it.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 10 September 2026. Subscribe to CISA (RSS)