CISA Plans Risk-Based Prioritization for Vulnerabilities and Critical Infrastructure
Summary
CISA plans to prioritize vulnerabilities by factors including asset exposure, exploitability and known exploited status, while issuing a binding directive for federal agencies and giving critical infrastructure owners more specific protection guidance.
Key points
- Acting Director Nick Andersen said CISA plans to issue a binding operational directive revising federal vulnerability management.
- The proposed approach considers whether assets are internet-exposed, vulnerabilities appear on CISA’s Known Exploited Vulnerabilities list, and exploitation is automatable.
- CISA plans more specific guidance to help critical infrastructure owners identify and protect the assets supporting their most critical functions.
- Andersen said CISA is working to hire 329 people, with job offers planned for 182 by the end of June; initial hiring will emphasize operational capabilities.
- CIRCIA town halls are scheduled to begin the following week, but Andersen did not set a date for finalizing the law’s regulations.
Article Details
- Event Type
- CISA announced plans to change how it prioritizes vulnerabilities and critical infrastructure risks, including a binding operational directive for federal agencies.
- Impact
- Federal vulnerability management is expected to place greater emphasis on asset criticality, internet exposure, exploitability, and inclusion in CISA’s Known Exploited Vulnerabilities list rather than applying every patch with equal urgency. Critical infrastructure owners and operators are expected to receive more specific guidance on protecting important assets. CIRCIA rulemaking town halls were delayed by government shutdowns and are scheduled to begin the following week; no finalization date for the regulations was provided.