CISA cyber & ICS and DC3 (DoD Cyber Crime Center / DCISE) threat products relevant to the DIB — each read by dex into a categorized card: the gist, why it matters, who's affected, and what to do.
Guidance
CISA
2026-09-23
CISA and FBI issue a fact sheet on securing ICS environments when working with third-party integrators.
This guidance highlights the importance of applying the principle of least privilege (PoLP) when granting third-party ICS integrators access to industrial control systems. Critical infrastructure operators should ensure that only the minimum necessary access is granted to protect against malicious cyber activities.
▸ DO Review and enforce the principle of least privilege for all third-party ICS integrators.
#mitigations#ics-ot#guidance
Guidance
CISA
2026-09-16
CISA guidance on using cyber decoys to strengthen detection and response against adversaries using legitimate credentials and LOTL techniques.
CISA provides guidance on implementing cyber decoys—assets that appear legitimate but are designed to distract, detect, or collect threat intelligence. These decoys complement Zero Trust models by supporting continuous monitoring, creating high-fidelity alerts, reducing alert fatigue, and helping detect post-compromise activity, including adversary living off the land (LOTL) techniques.
▸ DO Review and implement cyber decoy strategies such as tripwires, breadcrumbs, and honeytokens to strengthen detection and response capabilities.
#mitigations#zero-trust#detection#lotl
Guidance
CISA
2026-09-15
NIST and CISA release updated guidelines for protecting identity assertions, access tokens, and cryptographic mechanisms in hybrid and multi-cloud environments.
This interagency report provides federal agencies and cloud service providers with implementation recommendations to prevent adversaries from forging, stealing, or misusing signed tokens and assertions. It expands on NIST SP 800-53 and supports Executive Order 14306 by emphasizing Secure by Design principles for interoperable defense across cloud environments.
▸ DO Review token validation, secrets management, and detection controls against these updated recommendations.
#mitigations#cloud#identity
Guidance
CISA
2026-09-03
CISA and G7 urge organizations to begin transitioning to post-quantum cryptography to protect against future quantum computing threats.
CISA and the G7 Cyber Security Working Group released a call to action highlighting the urgent need for organizations to transition to post-quantum cryptography (PQC) to protect sensitive data and critical assets from emerging quantum computing threats. The report outlines five priorities for a successful transition, including raising awareness, developing national strategies, advancing research, fostering public-private partnerships, and integrating PQC into procurement processes.
▸ DO Review current cryptographic implementations and begin planning a transition to post-quantum cryptography.
#mitigations#guidance#quantum
Guidance
CISA
2026-09-02
CISA, FBI, and partners release best practices for clear, timely communication during IT/OT outages to prevent panic and limit speculation.
This guidance outlines how organizations should communicate during IT and operational technology outages caused by cyber threats, human error, or natural hazards. It emphasizes clarity, accountability, and transparency to inform stakeholders while aligning with legal and operational security requirements.
▸ DO Review and adopt CISA's crisis messaging best practices for IT/OT outages.
#mitigations#ot#guidance
Guidance
CISA
2026-08-26
CISA's Vulnerability Review highlights common software weaknesses and provides steps to address them proactively.
Most compromises exploit basic security failures and well-known software vulnerabilities rather than advanced techniques. The CISA Vulnerability Review analyzes vulnerability data from fiscal years 2024 and 2025 to establish a baseline and promote Secure by Design principles, helping organizations reduce systemic vulnerabilities instead of just reacting to individual flaws.
▸ DO Review the CISA Vulnerability Review to identify common software weaknesses and implement Secure by Design principles in your software development lifecycle.
#mitigations#guidance#vulnerability
Guidance
CISA
2026-08-25
CISA red team assessments reveal how detection tuning and response processes determine whether an organization can contain a breach.
CISA conducted red team assessments at two organizations, showing that Organization B's rapid detection and isolation contrasted with Organization A's failure to contain the attack. The advisory highlights lessons on detection tuning, response processes, and mitigations for IT, cloud, and OT environments.
▸ DO Review detection tool baselines and alert filtering to reduce false positives, and establish clear incident response procedures and defender authority.
#mitigations#detection#incident-response#ot#cloud#it
Guidance
CISA
2026-07-30
CISA released new guidance on securely managing open source software across its lifecycle.
This guidance helps agencies securely use, evaluate, and publish open source software by covering risk management, the C4 Framework for trust assessment, vulnerability management, software bill of materials, secure development, and handling open source AI systems.
▸ DO Review and apply the C4 Framework for trust assessment and update your open source software risk management processes.
#mitigations#oss#guidance
Guidance
CISA
2026-07-29
CISA and partners released updated 2026 minimum elements for Software Bills of Materials (SBOMs) to improve software supply chain transparency and risk management.
This joint guidance from CISA, NSA, and FBI updates the 2021 NTIA SBOM minimum elements, incorporating stakeholder feedback and current tools. Organizations should apply these baseline elements to all software, with additional considerations for AI and cloud SaaS, to better understand their software makeup and supply chains.
▸ DO Review and update your SBOM generation process to align with the 2026 minimum elements.
#guidance#supply-chain#mitigations
Guidance
CISA
2026-07-28
CISA and international partners released joint guidance on isolating vital operational technology systems during cyber incidents or crises.
This guidance provides practical steps for critical infrastructure organizations to isolate vital operational technology and enabling systems from all other networks in the event of disruption or crisis. By following these recommendations, organizations can enhance resilience, minimize disruption, and maintain essential services during cyber incidents or geopolitical crises.
▸ DO Review the guidance and implement isolation steps for vital operational technology systems.
#mitigations#ot#dib-sector
Guidance
CISA
2026-07-15
CISA, NSA, and partners release joint guidance on establishing Coordinated Vulnerability Disclosure (CVD) programs to work with security researchers.
This guidance provides best practices for software manufacturers and online service providers to design and implement a CVD program, including a clear vulnerability disclosure policy and process for triaging, remediating, and assigning CVE identifiers. Organizations can leverage third-party intermediaries like CISA to supplement their CVD program.
▸ DO Review and implement a Coordinated Vulnerability Disclosure (CVD) program aligned with this guidance.
#mitigations#vulnerability