Topic · enforcement

Enforcement

RSS feed ↗

trade-press
CISA compresses CIRCIA town halls into four June sessions
Four days in June is the last structured window to shape mandatory incident reporting rules that lock in May 2026, so the session schedule is also a signal about how much scope remains open.
CISA consolidated its CIRCIA rulemaking town hall series from eight sessions spread across multiple months into four concentrated sessions June 15-18, after the original February schedule was cancelled during the DHS shutdown. Critical infrastructure operators and their contractors have until those sessions to weigh in on the four-day incident reporting window and 24-hour ransom payment notification requirements before the final rule publishes in May 2026. The compression from eight sessions to four, all in a single week, suggests CISA has narrowed its remaining decision surface rather than reopened the file.
YESTERDAY
trade-press
Contractor GitHub repo exposed privileged CISA credentials
A public repository named "Private-CISA" held AWS GovCloud and internal system credentials dating to November, and Congress is not satisfied with CISA's response.
GitGuardian discovered a public GitHub repository last week, apparently maintained by a Nightwing contractor, containing privileged AWS GovCloud credentials and internal CISA system credentials dating back to November. The repository was named "Private-CISA." CISA says no sensitive data was confirmed compromised; the researcher who found it rated it among the worst leaks he has seen and cited state-actor persistence as the primary risk. House Homeland Security ranking members Thompson and Ramirez, plus Sen. Hassan, sent separate letters Tuesday demanding briefings on affected systems, forensic findings, and contractor accountability. Both Hill letters named CISA staffing and budget cuts as a potential contributing factor.
FRI
trade-press
Contractor-linked GitHub leak exposes CISA, DHS credentials
A "Private CISA" repository connected to contractor Nightwing sat publicly accessible long enough that Hill Democrats are now demanding a briefing on remediation and contractor accountability.
Researcher Brian Krebs reported Monday that a GitHub repository labeled "Private CISA," linked to government contractor Nightwing, publicly exposed authentication credentials, AWS GovCloud data, and internal CISA/DHS build-and-deploy documentation. The repository has since been removed. House Homeland Security ranking member Rep. Bennie Thompson and cyber subcommittee ranking member Rep. Delia Ramirez sent a Tuesday letter to acting CISA Director Nick Andersen demanding a briefing on the breach's scope, remediation steps, and corrective actions against contractor personnel. A separate letter came from Sen. Maggie Hassan. Nightwing referred questions to CISA; CISA declined to comment on congressional correspondence. Thompson and Ramirez also flagged CISA's recent workforce reductions as a potential contributing factor. Government Executive and Nextgov/FCW have not independently verified the repository's contents.
FRI
trade-press
Contractor exposed CISA credentials on public GitHub repo
House Democrats want answers on how Nightwing left CISA's internal access data publicly readable, and whether staff cuts set the conditions.
Researcher Brian Krebs reported Monday that a GitHub repository linked to government contractor Nightwing exposed CISA and DHS authentication credentials, AWS GovCloud access data, and internal build-and-deploy documentation, stored in a repo labeled "Private CISA" that was later removed. Reps. Bennie Thompson and Delia Ramirez, the top Democrats on the House Homeland Security Committee and its cyber subcommittee, sent CISA acting Director Nick Andersen a letter Tuesday demanding a briefing on how the exposure occurred, what was accessed, and what corrective action is planned for the contractor personnel involved. Sen. Maggie Hassan sent a separate letter the same day. Nextgov has not independently verified the repository's contents; Nightwing referred inquiries to CISA, which declined to comment publicly.
FRI
trade-press
USDA OIG finds AI systems deployed without required ATOs or governance
The department has a chief AI officer and an AI inventory. It doesn't have policies, risk controls, or authority-to-operate approvals for almost any of it.
A USDA OIG report released last week found the Agriculture Department has deployed AI across supply chain risk, crop yield estimation, and permitting without completing required cybersecurity and governance controls. Almost none of the AI use cases in the FY2024 inventory carried an authority to operate. USDA has no generative AI policy, hasn't updated agency-level AI policies, and hasn't implemented minimum risk management practices for high-risk AI systems, as required by OMB guidance. The OIG also flagged shadow AI risk, noting the department relies solely on an annual employee self-report to track AI use. USDA agreed with all recommendations.
FRI
regulator
CISA adds Langflow, Trend Micro Apex One CVEs to KEV catalog
BOD 22-01 remediation deadlines now apply to both; non-FCEB orgs should treat the listing as a prioritization signal.
CISA added two actively exploited CVEs to the Known Exploited Vulnerabilities catalog: CVE-2025-34291 (Langflow origin validation error) and CVE-2026-34926 (Trend Micro Apex One directory traversal). FCEB agencies must remediate by the posted due dates under BOD 22-01. Non-federal organizations are not bound but CISA urges prioritized patching for both.
FRI
regulator
CISA adds Cisco SD-WAN auth bypass to KEV Catalog
Emergency Directive 26-03 is already live; this KEV addition raises the remediation floor for FCEB agencies.
CVE-2026-20182, an authentication bypass in Cisco Catalyst SD-WAN Controller, is now in the KEV Catalog under active exploitation. FCEB agencies must remediate per BOD 22-01. CISA has also issued Emergency Directive 26-03 and supplemental hunt-and-hardening guidance specific to Cisco SD-WAN; follow both. If mitigations are unavailable, CISA says discontinue use.
FRI
regulator
CISA adds Microsoft Exchange XSS to KEV Catalog
FCEB agencies have a mandatory remediation deadline; everyone else has a strong nudge.
CISA added CVE-2026-42897, a Microsoft Exchange Server cross-site scripting vulnerability with evidence of active exploitation, to the KEV Catalog on May 15. BOD 22-01 requires FCEB agencies to remediate by the posted due date. Non-federal operators are not bound but should treat KEV listing as a prioritization signal in their vulnerability management programs.
FRI
regulator
CISA adds seven CVEs to KEV Catalog, two from 2026
Five of the seven entries are legacy vulnerabilities from 2008-2010, suggesting active exploitation of unpatched older systems alongside two current Microsoft Defender flaws.
CISA added seven CVEs to the Known Exploited Vulnerabilities Catalog on May 20, citing evidence of active exploitation. Five are legacy flaws dating to 2008-2010: a Microsoft Windows buffer overflow (CVE-2008-4250), a DirectX null-byte overwrite (CVE-2009-1537), an Adobe Acrobat heap buffer overflow (CVE-2009-3459), and two Internet Explorer use-after-free vulnerabilities (CVE-2010-0249, CVE-2010-0806). The two current entries are a Microsoft Defender elevation-of-privilege (CVE-2026-41091) and a Defender denial-of-service (CVE-2026-45498). BOD 22-01 requires FCEB agencies to remediate by the posted due dates. All others: check your KEV posture now.
FRI
trade-press
NIST splits AI incident response into two separate guidance tracks
The first federal framework to distinguish attacks on AI systems from harms caused by AI systems creates two distinct playbook obligations, and leaves liability allocation unresolved.
NIST announced two parallel work streams on AI incident response at a May 14 workshop in Gaithersburg: one updating existing cybersecurity guidelines to cover attacks on AI systems, a second establishing new recommendations for AI-induced incidents including misuse, malfunction, and unintentional harms. Federal contractors and defense industrial base organizations deploying AI will eventually face more granular playbook requirements than traditional NIST 800-171 incident response controls demand. Who bears liability across the developer-deployer-user stack remains an open question NIST has not yet answered.
THU
trade-press
GAO finds uneven search methods hide China-linked equipment on agency networks
Four agencies reporting zero findings while DOD and DOE found covered devices is a methodology gap, not a clean bill of health.
A May 19 GAO report on six federal agencies' compliance with the Section 899 NDAA prohibition on China-linked telecom and video surveillance equipment found that only DOD conducted physical searches, and only DOD and DOE found covered devices. DHS, DOJ, State, and Treasury all reported zero findings, but none ran physical searches. GAO identified procurement record gaps, supply-chain opacity, and rebranding as structural limits on every agency's search approach. The divergence in methods makes the zero-finding results hard to read as actual risk clearance.
THU
trade-press
Draft EO sets 2030-2031 federal PQC migration deadlines for agencies and contractors
For the first time, post-quantum cryptography gets binding deadlines with teeth, closing the three-year gap since NSA told agencies to migrate without requiring them to.
A White House draft executive order would require federal agencies to migrate key establishment systems to post-quantum cryptography (PQC) by Dec. 31, 2030, and digital signatures on high-impact systems by Dec. 31, 2031. "Covered contractors" face the same 2030 key establishment deadline under NIST PQC standards. The order tasks OMB with issuing implementation guidance. Critical open questions remain: whether "covered contractors" sweeps in all subcontractors or only primes above a threshold, and what enforcement mechanism OMB will specify, the same gap that made NSA's 2022 quantum-resistant guidance effectively optional for four years.
THU