TIC 3.0

1. 2026-09-23 Low
   CISA publishes TIC 3.0 Cloud Use Case

   CISA has published the TIC 3.0 Cloud Use Case document to provide guidance on implementing Trusted Internet Connection 3.0 standards in cloud environments. This resource helps …

   Guidance

2. 2026-09-23 Low
   CISA publishes Branch Office Use Case for Trusted Internet Connection 3.0

   CISA has published a use case document for implementing Trusted Internet Connection (TIC) 3.0 in branch office environments. This guidance provides organizations with specific recommendations and …

   Guidance

3. 2026-09-23 Low
   CISA publishes Remote User Use Case documentation for TIC 3.0

   CISA has published a Remote User Use Case document as part of its Trusted Internet Connections 3.0 (TIC 3.0) program. This guidance provides federal agencies with …

   Guidance

4. 2026-09-23 Info
   CISA publishes Security Capabilities Catalog for Trusted Internet Connection program

   CISA has published the Security Capabilities Catalog as part of the Trusted Internet Connection (TIC) 3.0 program. This catalog outlines the security capabilities and requirements that …

   Other

5. 2026-09-23 Low
   CISA publishes Trusted Internet Connection 3.0 Use Case Handbook

   CISA has published the Trusted Internet Connection 3.0 Use Case Handbook to provide organizations with practical implementation guidance. The handbook offers detailed use cases and examples …

   Guidance

1. 2026-09-23 TIC 3.0 core guidance documents re-issued with administrative updates
2. 2026-02-05 CISA BOD 26-02 on end-of-support edge devices refers agencies to the TIC 3.0 capability catalog for edge device refreshes
3. 2019-09-12 OMB M-19-26 launches TIC 3.0 and rescinds the earlier TIC memoranda that required routing traffic through physical TIC access points; within one year of its release, agencies must update their network and system boundary policies and choose allowed TIC use cases

1. 2026-09-23
   TIC 3.0 core guidance (September 2026 administrative update) ErrataCurrent text

   All core guidance documents re-issued to reflect organisational changes at CISA. source

   More

   • The update was primarily administrative, with no technical content changes.
   • The Security Capabilities Catalog stays at version 3.3; its only 2026 changes were updated footnote links.
2. —
   Security Capabilities Catalog 3.3 Errata

   Removed the National Cybersecurity Protection System (NCPS) reference in Appendix A. source

3. —
   Security Capabilities Catalog 3.2 Revision

   Added Govern to the security objectives mapped to the NIST CSF (now six) and updated the capability list using NIST's CSF 2.0 mappings. source

4. —
   Security Capabilities Catalog 3.1 Revision

   Removed the EINSTEIN 3 Accelerated (E3A) email protections capability. source

5. —
   Security Capabilities Catalog 3.0 Major version

   Added five universal capabilities (supply chain risk management, resource lifecycle management, security test and exercise, continuous monitoring reporting, governance and policy auditing) and eleven email capabilities. source

   More

   • It also added network detection and response, unified communications protections, data labeling and inventory, and new Services and Identity capability groups.
   • CISA's Protective DNS replaced EINSTEIN 3A DNS protections.

M-19-26 directs federal agencies to apply TIC 3.0.

Federal agencies

M-19-26 directs federal agencies to apply TIC 3.0. source source

TIC access points

It no longer requires traffic to pass through a TIC access point when an agency uses an approved alternative; the use cases give guardrails for those scenarios. source source

Core guidance

Agencies use the Program Guidebook, Reference Architecture and Security Capabilities Catalog to protect their environments according to their risk tolerance. source

Vendors

Vendors use the Overlay Handbook to map their products to TIC capabilities. source

Under M-19-26, OMB and DHS track agency implementation through FISMA reporting, and DHS, with GSA and NIST, is directed to develop a compliance verification process.

Tracking

M-19-26 says OMB and DHS will track agency implementation through FISMA reporting. source

Use cases

Under M-19-26, each agency identifies which TIC Use Cases it will allow. source

Compliance verification

M-19-26 directs DHS, with GSA and NIST, to develop a compliance verification process to validate that agencies are implementing the security controls required by TIC Use Cases. source

M-19-26 directs federal agencies to apply TIC, and OMB and DHS track implementation through FISMA reporting.

OMB direction

M-19-26 directed federal agencies to update their network and system boundary policies to reflect it within one year. source

Oversight

M-19-26 says OMB and DHS will track agency implementation through FISMA reporting. source

1. Standard TIC 3.0 core guidance documents (Program Guidebook, Reference Architecture, Security Capabilities Catalog, Use Case Handbook, Overlay Handbook, use cases)
2. Standard TIC 3.0 Security Capabilities Catalog, version 3.3 (PDF, September 2026)
3. Guidance TIC 3.0 Cloud Use Case (PDF, September 2026)
4. Law text OMB M-19-26 – Update to the Trusted Internet Connections (TIC) Initiative
5. Guidance CISA Trusted Internet Connections program page

1. NIST SP 800-207

   NIST SP 800-207 defines zero trust architecture; CISA presents TIC 3.0 as a pathway for agencies to implement it.

2. FedRAMP

   FedRAMP authorizes cloud services; TIC 3.0 sets how agencies secure the network connections to and from those services.

3. CISA

   CISA's binding operational directives impose specific mandatory actions; TIC 3.0 is the architecture guidance agencies apply under OMB M-19-26.

4. NIST CSF

   The CSF is NIST's outcome framework; the TIC catalog maps its security objectives to the CSF 2.0 functions.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to TIC 3.0 (RSS)