# cisa Published articles for cisa. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## CISA decides weekly vulnerability bulletin isn't necessary anymore DevFeed: [CISA decides weekly vulnerability bulletin isn't necessary anymore]() Original publisher: [Read original article]() Author: Brandon Vigliarolo Published: 2026-09-16T20:33:48Z Content type: article Language: en Sources: [www.theregister.com - Articles]() Topics: [cisa](), [vulnerability](), [Security]() Tags: [cisa](), [common-vulnerability-scoring-system](), [infosec](), [security](), [vulnerability]() ### AI overview CISA is ending its weekly vulnerability bulletin on September 28, shifting from static CVSS scores to risk-based prioritization. ### Source excerpt Agency's shift from static CVSS scores to risk-based prioritization sends the old format packing September 28 ## CISA's Logging Reference Architecture for OMB M-26-14: What federal agencies should do next DevFeed: [CISA's Logging Reference Architecture for OMB M-26-14: What federal agencies should do next]() Original publisher: [Read original article]() Author: Woody Walton Published: 2026-09-16T00:00:00Z Content type: article Language: en Sources: [Elastic Blog - Elasticsearch, Kibana, and ELK Stack]() Topics: [cisa](), [Logging](), [cybersecurity and infrastructure security agency](), [log management](), [Architecture & Design](), [implementation](), [audit](), [Security]() Tags: [architecture](), [audit](), [cisa](), [cybersecurity-and-infrastructure-security-agency](), [cybersecurity-open-source-standards-log-management-government](), [government](), [implementation](), [logging](), [logs](), [public-sector](), [security]() ### AI overview This Elastic blog explains CISA's Logging Reference Architecture for OMB M-26-14 and the actions federal civilian executive branch agencies must take. It highlights planning and maturity deadlines, recommends assessing existing capabilities and documenting gaps, and discusses storage tiers, retrieval, immutability, and audit requirements. ### Source excerpt Now that CISA has released its Logging Reference Architecture (LRA) for OMB M-26-14, federal agencies tasked to complete their logging plans. In this blog, we walk you through the most important aspects of the LRA guidance. ## Perfect-10 GitLab bug under attack days after patch lands DevFeed: [Perfect-10 GitLab bug under attack days after patch lands]() Original publisher: [Read original article]() Author: Carly Page Published: 2026-09-14T14:30:00Z Content type: news Language: en Sources: [www.theregister.com - Articles]() Topics: [GitLab](), [bug](), [Cybersecurity](), [Internet](), [servers]() Tags: [bug](), [cisa](), [cybersecurity](), [cybersecurity-and-infrastructure-security-agency](), [exploit](), [gitlab](), [internet](), [security](), [servers]() ### AI overview CISA confirms active exploitation of a critical GitLab vulnerability shortly after a patch was released. Security researchers observed attackers probing internet-facing servers. ### Source excerpt CISA confirms active exploitation as watchTowr spots miscreants probing internet-facing servers ## Hydrate, Hack, Repeat: Security Summer Camp 2026 DevFeed: [Hydrate, Hack, Repeat: Security Summer Camp 2026]() Original publisher: [Read original article]() Author: jgamblin Published: 2026-07-22T21:34:54Z Content type: opinion Language: en Sources: [Jerry Gamblin]() Topics: [Security](), [vulnerability management](), [vulnerability](), [data](), [Artificial Intelligence]() Tags: [2026](), [ai](), [black-hat](), [bsides](), [cisa](), [con](), [cves](), [data](), [kev-catalog](), [management](), [models](), [research](), [security](), [talks](), [uncategorized](), [vulnerability](), [vulnerability-management]() ### AI overview A personal guide to the author's 2026 security conference schedule, new role as Head of Research at Empirical Security, and recommended CVE and vulnerability talks. It argues that effective vulnerability management requires granular, transparent, accurate data, citing the growth in CVEs and the limited share listed in CISA KEV. ### Source excerpt My schedule, a new role at Empirical Security, and the CVE and vulnerability talks worth your time. It is almost the first week of August, which means it is time to point myself at the desert one more time. BSides Las Vegas, Black Hat, and DEF CON all land back to back, and for me ... Read more ## Going beyond CVEs: Chainguard's one day KEV SLA DevFeed: [Going beyond CVEs: Chainguard's one day KEV SLA]() Original publisher: [Read original article]() Published: 2026-04-28T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [Vulnerabilities](), [chainguard containers](), [Security](), [cisa]() Tags: [chainguard](), [chainguard-containers](), [chainguard-cves](), [chainguard-images](), [chainguard-kevs](), [cisa](), [containers](), [cves](), [exploited-vulnerabilities](), [kevs](), [known-exploitable-vulnerabilities](), [security]() ### AI overview Chainguard announces a one-calendar-day SLA for remediating CVEs added to the CISA Known Exploited Vulnerabilities Catalog when they affect Chainguard container images. The article explains the SLA's relationship to exploited-vulnerability prioritization and Chainguard's continuous remediation processes. ### Source excerpt Chainguard introduces a 1-day KEV SLA, ensuring exploited vulnerabilities are fixed fast--aligned with how security teams prioritize real-world threats. ## Snyk Joins CISA's Secure by Design Pledge DevFeed: [Snyk Joins CISA's Secure by Design Pledge]() Original publisher: [Read original article]() Author: Brian Campbell Published: 2025-08-05T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Application Security](), [Security & Privacy](), [MFA](), [cybersecurity and infrastructure security agency](), [passwords](), [Security](), [vulnerability]() Tags: [application-security](), [authentication](), [awareness](), [blog](), [cisa](), [compliance](), [customer](), [cybersecurity](), [devops](), [devsecops](), [executive](), [mfa](), [open-source-security](), [passwords](), [secure-by-design](), [secure-by-design-pledge](), [security](), [snyk](), [snyk-code](), [snyk-open-source](), [snyk-platform](), [software](), [supply-chain-security](), [vulnerabilities]() ### AI overview Snyk's CISO describes the company's decision to join CISA's Secure by Design pledge. The article presents the pledge as a set of measurable goals for improving product security, including secure-by-default practices, MFA, eliminating default passwords, and reducing vulnerabilities before software reaches users. ### Source excerpt Snyk's CISO explains why we've joined CISA's Secure by Design pledge. Learn about the 7 key goals for a safer digital world, including MFA, no default passwords, and vulnerability reduction. ## One Year Later: Signing CISA's Secure by Design Pledge DevFeed: [One Year Later: Signing CISA's Secure by Design Pledge]() Original publisher: [Read original article]() Published: 2025-06-10T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [cisa](), [cve remediation](), [container images](), [MFA](), [Security](), [Single sign-on (SSO)](), [passwords](), [chainguard vms](), [ssh]() Tags: [authentication](), [chainguard](), [chainguard-containers](), [chainguard-vms](), [cisa](), [container-images](), [cve](), [cve-remediation](), [mfa](), [okta](), [password](), [passwords](), [secure-by-design](), [secure-by-design-pledge](), [secure-software](), [security](), [shift-left](), [ssh](), [sso](), [vulnerabilities](), [vulnerability-management]() ### AI overview Chainguard reviews its progress one year after signing CISA's Secure by Design pledge, including CVE remediation across its container images, company-wide MFA through Okta SSO, and password-free access with automated SSH key provisioning for Chainguard VMs. ### Source excerpt Chainguard signed CISA's Secure by Design pledge in 2024. One year later, we look at progress we've made in key areas like CVE remediation and disclosures. ## Chainguard Signs CISA's Secure Software Development Attestation Form DevFeed: [Chainguard Signs CISA's Secure Software Development Attestation Form]() Original publisher: [Read original article]() Published: 2025-02-24T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [chainguard](), [open-source-security](), [Cybersecurity]() Tags: [announce](), [chainguard](), [chainguard-images](), [cisa](), [container-images](), [cybersecurity](), [fedramp](), [government](), [nist](), [product-security](), [provenance](), [secure-software](), [software-supply-chain-security](), [standards](), [supply-chain-attacks](), [supply-chain-security]() ### AI overview Chainguard announces that it has signed CISA's Secure Software Development Attestation Form. The attestation states that Chainguard products align with NIST's Secure Software Development Framework and federal software supply chain security requirements, including secure development environments, trusted source code supply chains, automated controls, and provenance data. ### Source excerpt Chainguard has recently signed CISA's Secure Software Development Attestation Form, attesting to the security of Chainguard and its products. ## Cisco Umbrella for Government: DNS Security Integrated With CISA Protective DNS DevFeed: [Cisco Umbrella for Government: DNS Security Integrated With CISA Protective DNS]() Original publisher: [Read original article]() Author: Christina Hausman Published: 2024-08-29T08:00:00Z Content type: release Language: en Sources: [OpenDNS]() Topics: [Security](), [Cisco](), [cisa]() Tags: [cisa](), [cisco](), [cisco-umbrella-for-government](), [cybersecurity-and-infrastructure-security-agency](), [dns](), [dns-layer-security](), [dns-security](), [fedramp](), [government](), [government-cybersecurity](), [malware](), [phishing](), [products-services](), [security]() ### AI overview Cisco Umbrella for Government has achieved FedRAMP Moderate authorization and integrates with CISA Protective DNS. The integration provides DNS-layer protection against malware and phishing and supports on-premises and roaming users across several device platforms. ### Source excerpt Cisco Umbrella for Government has achieved FedRAMP Moderate authorization*. Eligible customers can now leverage Cisco Umbrella for Government for robust DNS security and to meet the mandate for CISA's Protective DNS with enhanced protection for on-premises and roaming client users. Cisco Umbrella DNS-layer security proactively protects against malware and phishing attacks by blocking access to [...] The post Cisco Umbrella for Government: DNS Security Integrated With CISA Protective DNS appeared first on Cisco Umbrella. ## NVD updates: CVSS v4.0, CISA data, and more DevFeed: [NVD updates: CVSS v4.0, CISA data, and more]() Original publisher: [Read original article]() Published: 2024-07-10T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [NVD](), [vulnerability management](), [cisa](), [vulnerability](), [Cybersecurity]() Tags: [cisa](), [cvss-v4-0](), [cybersecurity](), [github](), [nvd](), [open-source](), [vulnerability](), [vulnerability-management](), [vulnrichment]() ### AI overview The article explains recent updates to the National Vulnerability Database, including its integration of CISA's Vulnrichment project and enriched CVSS and CWE data. It describes how more complete vulnerability information can help security scanners and teams prioritize and manage vulnerabilities. ### Source excerpt Learn about the NVD's recent updates, including CISA Vulnrichment data, CVSS v4.0 integration, and how they impact your vulnerability management workflow. ## Signing CISA's Secure by Design pledge DevFeed: [Signing CISA's Secure by Design pledge]() Original publisher: [Read original article]() Published: 2024-05-08T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [cisa](), [MFA](), [Security](), [Single sign-on (SSO)](), [OpenID connect (OIDC)](), [passwords](), [Auth0](), [Web]() Tags: [auth0](), [authentication](), [best-practices](), [chainguard](), [cisa](), [cve](), [mfa](), [oidc](), [password](), [passwords](), [phishing](), [secure-by-default](), [secure-by-design](), [secure-by-design-pledge](), [secure-software](), [security](), [security-best-practices](), [sso]() ### AI overview Chainguard describes signing CISA's Secure by Design pledge and explains how its products and internal systems address the pledge's goals. The article discusses passwordless human login through SSO, MFA requirements, phishing-resistant security keys, and limitations in provider support for OIDC MFA claims. ### Source excerpt Chainguard proudly signs CISA's Secure by Design pledge. Learn why we support this critical software security initiative. ## Working with government and industry to put open source security tooling into practice DevFeed: [Working with government and industry to put open source security tooling into practice]() Original publisher: [Read original article]() Published: 2023-09-12T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [open-source-security](), [software bill of materials](), [supply-chain-security](), [Tooling](), [cisa](), [Docker Hardened Images]() Tags: [bombshell](), [chainguard](), [cisa](), [cyclonedx](), [open-source](), [open-source-security](), [protobom](), [sbom](), [security](), [software-bill-of-materials](), [software-supply-chain-security](), [spdx](), [vex]() ### AI overview Chainguard describes two open-source SBOM tools developed with the U.S. Department of Homeland Security and other startups: protobom, which translates SBOM data between formats, and bomshell, which combines and composes SBOMs. The initiative aims to improve software supply chain security and visibility. ### Source excerpt Pioneering SBOM tools with government and industry allies, Chainguard advances open source security measures. ## What every CISO should know about the new SSDF security self-attestation form DevFeed: [What every CISO should know about the new SSDF security self-attestation form]() Original publisher: [Read original article]() Published: 2023-08-08T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [cisa](), [Cybersecurity](), [Security]() Tags: [chainguard-images](), [cisa](), [cve](), [cybersecurity](), [fedramp](), [regulatory](), [secure-software](), [secure-software-development-frameworks](), [self-attestation](), [software-security-audit](), [software-supply-chain-security](), [ssdf](), [standards](), [vulnerability-management]() ### AI overview This joint blog post explains a proposed Secure Software Self-Attestation Form published by CISA and its implications for CISOs. It describes how organizations selling software for government use may need to attest to their best efforts to follow NIST's Secure Software Development Framework, while highlighting related software supply chain security practices and regulatory developments. ### Source excerpt Explore the pivotal SSDF Security Self-Attestation Form, a key resource for CISOs to navigate and enhance security compliance. ## Can Protobom end the SBOM format wars? DevFeed: [Can Protobom end the SBOM format wars?]() Original publisher: [Read original article]() Published: 2023-07-31T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [Open Source](), [Library](), [open-source-security]() Tags: [cisa](), [collaboration](), [cyclonedx](), [library](), [open-source](), [protobom](), [pull-requests](), [sbom](), [sboms](), [security](), [software-bill-of-materials](), [software-supply-chain](), [software-supply-chain-security](), [spdx]() ### AI overview The article presents Protobom as an open source library designed to reduce the importance of choosing among SBOM formats. It provides a format-neutral representation of SBOM package and file data and translates that data between popular formats, allowing teams to focus more on software supply chain security. ### Source excerpt Probe the SBOM format wars: Can ProtoBOM herald a new era of consensus? Chainguard weighs in. ## Strengthening CI/CD Environments: Insights from NSA and DHS CISA guidance DevFeed: [Strengthening CI/CD Environments: Insights from NSA and DHS CISA guidance]() Original publisher: [Read original article]() Published: 2023-06-30T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [CI/CD](), [supply-chain-security](), [DevSecOps](), [Cybersecurity](), [cisa]() Tags: [chainguard-images](), [ci-cd](), [cicd](), [cisa](), [continuous-verification](), [cybersecurity](), [devsecops](), [secure-software-development-frameworks](), [security](), [sigstore](), [slsa](), [software-supply-chain](), [software-supply-chain-security](), [ssdf]() ### AI overview This commentary explains NSA and DHS CISA guidance for securing CI/CD environments. It highlights risks to downstream environments and software consumers, including compromised developer credentials and application libraries, and recommends established software supply chain security frameworks such as SLSA and CNCF best practices. ### Source excerpt Fortify your CI/CD environments with insights from NSA and DHS CISA guidance, presented by Chainguard. ## Government perspectives on software self-attestation requirements DevFeed: [Government perspectives on software self-attestation requirements]() Original publisher: [Read original article]() Published: 2023-06-15T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [cisa](), [Cybersecurity](), [chainguard](), [Security]() Tags: [chainguard](), [cisa](), [cybersecurity](), [fedramp](), [nist](), [open-source-security](), [regulatory](), [secure-by-design](), [security](), [self-attestation](), [software-supply-chain](), [software-supply-chain-security](), [ssdf]() ### AI overview Chainguard CEO Dan Lorenc and CISA Fellow Chris Hughes discuss CISA's draft software self-attestation form, its relationship to federal software supply chain security requirements, and the regulatory context surrounding secure software development. ### Source excerpt Chainguard CEO Dan Lorenc and Chris Hughes, CISO & Cofounder of Aquia and CISA Fellow discuss the upcoming software self-attestation form. ## Celebrating 5 years of NTIA's SBOM work DevFeed: [Celebrating 5 years of NTIA's SBOM work]() Original publisher: [Read original article]() Published: 2023-06-07T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [Cybersecurity](), [Security](), [chainguard](), [cisa](), [distroless]() Tags: [chainguard](), [cisa](), [cybersecurity](), [distroless](), [fedramp](), [openvex](), [sbom](), [software-bill-of-materials](), [software-dark-matter](), [software-supply-chain](), [software-supply-chain-security](), [sofware-supply-chain](), [ssdf](), [vex](), [vulnerability-scanning]() ### AI overview The article commemorates five years of the NTIA's Software Bill of Materials work and reviews the development of SBOMs as a foundation of software supply chain security. It describes the NTIA's initiative, its multi-stakeholder guidelines, and CISA's continuing role in advancing software transparency. ### Source excerpt Celebrate 5 transformative years of SBOM work with Chainguard, reflecting on the journey of software bill of materials. ## How to explain the CISA software attestation requirements to your board DevFeed: [How to explain the CISA software attestation requirements to your board]() Original publisher: [Read original article]() Published: 2023-05-05T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [cisa](), [cybersecurity and infrastructure security agency](), [software bill of materials](), [Security]() Tags: [attestation](), [chainguard](), [cisa](), [container-security](), [government](), [national-cybersecurity-strategy](), [nist](), [policy](), [sbom](), [sboms](), [secure-container-image](), [secure-software](), [self-attestation](), [signing-artifacts](), [sigstore](), [software-artifact-signing](), [software-bill-of-materials](), [software-supply-chain-security](), [ssdf]() ### AI overview This article explains how software companies can brief their boards on CISA software attestation requirements and the broader federal software supply chain security policy landscape. It discusses Executive Order 14028, SBOMs, secure software development, CISA's Secure Software Development Attestation Form, and the requirements in OMB Memorandum M-22-18, including alignment with NIST guidance. ### Source excerpt CISA's draft self-attestation form clarifies the minimum requirements that software developers must meet to comply with OMB Memorandum M-22-18.