# cisa The Cybersecurity and Infrastructure Security Agency (CISA) is a U.S. agency responsible for protecting the nation's critical infrastructure from physical and cyber threats. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## CISA decides weekly vulnerability bulletin isn't necessary anymore DevFeed: [CISA decides weekly vulnerability bulletin isn't necessary anymore]() Original publisher: [Read original article]() Author: Brandon Vigliarolo Published: 2026-09-16T20:33:48Z Content type: article Language: en Sources: [www.theregister.com - Articles]() Topics: [cisa](), [vulnerability](), [Security]() Tags: [cisa](), [common-vulnerability-scoring-system](), [infosec](), [security](), [vulnerability]() ### AI overview CISA is ending its weekly vulnerability bulletin on September 28, shifting from static CVSS scores to risk-based prioritization. ### Source excerpt Agency's shift from static CVSS scores to risk-based prioritization sends the old format packing September 28 ## CISA's Logging Reference Architecture for OMB M-26-14: What federal agencies should do next DevFeed: [CISA's Logging Reference Architecture for OMB M-26-14: What federal agencies should do next]() Original publisher: [Read original article]() Author: Woody Walton Published: 2026-09-16T00:00:00Z Content type: article Language: en Sources: [Elastic Blog - Elasticsearch, Kibana, and ELK Stack]() Topics: [cisa](), [Logging](), [cybersecurity and infrastructure security agency](), [log management](), [Architecture & Design](), [implementation](), [audit](), [Security]() Tags: [architecture](), [audit](), [cisa](), [cybersecurity-and-infrastructure-security-agency](), [cybersecurity-open-source-standards-log-management-government](), [government](), [implementation](), [logging](), [logs](), [public-sector](), [security]() ### AI overview This Elastic blog explains CISA's Logging Reference Architecture for OMB M-26-14 and the actions federal civilian executive branch agencies must take. It highlights planning and maturity deadlines, recommends assessing existing capabilities and documenting gaps, and discusses storage tiers, retrieval, immutability, and audit requirements. ### Source excerpt Now that CISA has released its Logging Reference Architecture (LRA) for OMB M-26-14, federal agencies tasked to complete their logging plans. In this blog, we walk you through the most important aspects of the LRA guidance. ## CVE Mid-Year 2026 Check-In: Volume Vertical, Exploitation Rare DevFeed: [CVE Mid-Year 2026 Check-In: Volume Vertical, Exploitation Rare]() Original publisher: [Read original article]() Author: jgamblin Published: 2026-07-01T15:47:10Z Content type: article Language: en Sources: [Jerry Gamblin]() Topics: [Vulnerabilities](), [Security](), [Statistics](), [cisa]() Tags: [2026](), [comparison](), [cve](), [cves](), [report](), [security](), [statistics](), [uncategorized](), [vulnerabilities]() ### AI overview This mid-year review finds that 35,364 CVEs were published in the first half of 2026, up 49.5% from the same period in 2025, while only 85 had entered CISA's KEV list. The article argues that the main challenge is distinguishing exploitable vulnerabilities from the rapidly growing volume of disclosures. ### Source excerpt We are halfway through 2026, so it is time for the mid-year CVE check-in. The short version: the volume curve has gone vertical while exploitation has not. This review covers everything published in the first half of 2026 (Jan 1 - Jun 30, 2026), the volume, the severity, what is actually being exploited, and who ... Read more ## Going beyond CVEs: Chainguard's one day KEV SLA DevFeed: [Going beyond CVEs: Chainguard's one day KEV SLA]() Original publisher: [Read original article]() Published: 2026-04-28T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [Vulnerabilities](), [chainguard containers](), [Security](), [cisa]() Tags: [chainguard](), [chainguard-containers](), [chainguard-cves](), [chainguard-images](), [chainguard-kevs](), [cisa](), [containers](), [cves](), [exploited-vulnerabilities](), [kevs](), [known-exploitable-vulnerabilities](), [security]() ### AI overview Chainguard announces a one-calendar-day SLA for remediating CVEs added to the CISA Known Exploited Vulnerabilities Catalog when they affect Chainguard container images. The article explains the SLA's relationship to exploited-vulnerability prioritization and Chainguard's continuous remediation processes. ### Source excerpt Chainguard introduces a 1-day KEV SLA, ensuring exploited vulnerabilities are fixed fast--aligned with how security teams prioritize real-world threats. ## Prioritizing What Matters: Bringing CVE Intelligence to Splunk DevFeed: [Prioritizing What Matters: Bringing CVE Intelligence to Splunk]() Original publisher: [Read original article]() Author: jgamblin Published: 2026-04-18T23:50:46Z Content type: release Language: en Sources: [Jerry Gamblin]() Topics: [Vulnerabilities](), [Security](), [dashboards](), [Open Source](), [configuration](), [cisa](), [FIRST]() Tags: [api](), [configuration](), [cve](), [dashboards](), [net](), [open-source](), [release](), [security](), [uncategorized](), [vulnerabilities](), [vulnerability]() ### AI overview An update to the free, open-source CVE Intelligence TA for Splunk adds EPSS, CISA KEV, and CISA SSVC enrichment to a vulnerability database. Version 2.0 includes a pre-joined Risk Priority lookup, four Dashboard Studio views, and automatic hourly updates without API keys or setup pages. ### Source excerpt I spend a significant amount of my time thinking about EPSS, CVSS, and the inherent gaps in how we prioritize vulnerabilities. We all know the drill: a 9.8 CRITICAL that remains unexploited shouldn't jump the line ahead of a 7.5 HIGH that is being actively used in the wild. Closing that gap between theoretical severity ... Read more ## One Year Later: Signing CISA's Secure by Design Pledge DevFeed: [One Year Later: Signing CISA's Secure by Design Pledge]() Original publisher: [Read original article]() Published: 2025-06-10T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [cisa](), [cve remediation](), [container images](), [MFA](), [Security](), [Single sign-on (SSO)](), [passwords](), [chainguard vms](), [ssh]() Tags: [authentication](), [chainguard](), [chainguard-containers](), [chainguard-vms](), [cisa](), [container-images](), [cve](), [cve-remediation](), [mfa](), [okta](), [password](), [passwords](), [secure-by-design](), [secure-by-design-pledge](), [secure-software](), [security](), [shift-left](), [ssh](), [sso](), [vulnerabilities](), [vulnerability-management]() ### AI overview Chainguard reviews its progress one year after signing CISA's Secure by Design pledge, including CVE remediation across its container images, company-wide MFA through Okta SSO, and password-free access with automated SSH key provisioning for Chainguard VMs. ### Source excerpt Chainguard signed CISA's Secure by Design pledge in 2024. One year later, we look at progress we've made in key areas like CVE remediation and disclosures. ## Cisco Umbrella for Government: DNS Security Integrated With CISA Protective DNS DevFeed: [Cisco Umbrella for Government: DNS Security Integrated With CISA Protective DNS]() Original publisher: [Read original article]() Author: Christina Hausman Published: 2024-08-29T08:00:00Z Content type: release Language: en Sources: [OpenDNS]() Topics: [Security](), [Cisco](), [cisa]() Tags: [cisa](), [cisco](), [cisco-umbrella-for-government](), [cybersecurity-and-infrastructure-security-agency](), [dns](), [dns-layer-security](), [dns-security](), [fedramp](), [government](), [government-cybersecurity](), [malware](), [phishing](), [products-services](), [security]() ### AI overview Cisco Umbrella for Government has achieved FedRAMP Moderate authorization and integrates with CISA Protective DNS. The integration provides DNS-layer protection against malware and phishing and supports on-premises and roaming users across several device platforms. ### Source excerpt Cisco Umbrella for Government has achieved FedRAMP Moderate authorization*. Eligible customers can now leverage Cisco Umbrella for Government for robust DNS security and to meet the mandate for CISA's Protective DNS with enhanced protection for on-premises and roaming client users. Cisco Umbrella DNS-layer security proactively protects against malware and phishing attacks by blocking access to [...] The post Cisco Umbrella for Government: DNS Security Integrated With CISA Protective DNS appeared first on Cisco Umbrella. ## NVD updates: CVSS v4.0, CISA data, and more DevFeed: [NVD updates: CVSS v4.0, CISA data, and more]() Original publisher: [Read original article]() Published: 2024-07-10T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [NVD](), [vulnerability management](), [cisa](), [vulnerability](), [Cybersecurity]() Tags: [cisa](), [cvss-v4-0](), [cybersecurity](), [github](), [nvd](), [open-source](), [vulnerability](), [vulnerability-management](), [vulnrichment]() ### AI overview The article explains recent updates to the National Vulnerability Database, including its integration of CISA's Vulnrichment project and enriched CVSS and CWE data. It describes how more complete vulnerability information can help security scanners and teams prioritize and manage vulnerabilities. ### Source excerpt Learn about the NVD's recent updates, including CISA Vulnrichment data, CVSS v4.0 integration, and how they impact your vulnerability management workflow. ## Signing CISA's Secure by Design pledge DevFeed: [Signing CISA's Secure by Design pledge]() Original publisher: [Read original article]() Published: 2024-05-08T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [cisa](), [MFA](), [Security](), [Single sign-on (SSO)](), [OpenID connect (OIDC)](), [passwords](), [Auth0](), [Web]() Tags: [auth0](), [authentication](), [best-practices](), [chainguard](), [cisa](), [cve](), [mfa](), [oidc](), [password](), [passwords](), [phishing](), [secure-by-default](), [secure-by-design](), [secure-by-design-pledge](), [secure-software](), [security](), [security-best-practices](), [sso]() ### AI overview Chainguard describes signing CISA's Secure by Design pledge and explains how its products and internal systems address the pledge's goals. The article discusses passwordless human login through SSO, MFA requirements, phishing-resistant security keys, and limitations in provider support for OIDC MFA claims. ### Source excerpt Chainguard proudly signs CISA's Secure by Design pledge. Learn why we support this critical software security initiative. ## Working with government and industry to put open source security tooling into practice DevFeed: [Working with government and industry to put open source security tooling into practice]() Original publisher: [Read original article]() Published: 2023-09-12T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [open-source-security](), [software bill of materials](), [supply-chain-security](), [Tooling](), [cisa](), [Docker Hardened Images]() Tags: [bombshell](), [chainguard](), [cisa](), [cyclonedx](), [open-source](), [open-source-security](), [protobom](), [sbom](), [security](), [software-bill-of-materials](), [software-supply-chain-security](), [spdx](), [vex]() ### AI overview Chainguard describes two open-source SBOM tools developed with the U.S. Department of Homeland Security and other startups: protobom, which translates SBOM data between formats, and bomshell, which combines and composes SBOMs. The initiative aims to improve software supply chain security and visibility. ### Source excerpt Pioneering SBOM tools with government and industry allies, Chainguard advances open source security measures. ## What every CISO should know about the new SSDF security self-attestation form DevFeed: [What every CISO should know about the new SSDF security self-attestation form]() Original publisher: [Read original article]() Published: 2023-08-08T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [cisa](), [Cybersecurity](), [Security]() Tags: [chainguard-images](), [cisa](), [cve](), [cybersecurity](), [fedramp](), [regulatory](), [secure-software](), [secure-software-development-frameworks](), [self-attestation](), [software-security-audit](), [software-supply-chain-security](), [ssdf](), [standards](), [vulnerability-management]() ### AI overview This joint blog post explains a proposed Secure Software Self-Attestation Form published by CISA and its implications for CISOs. It describes how organizations selling software for government use may need to attest to their best efforts to follow NIST's Secure Software Development Framework, while highlighting related software supply chain security practices and regulatory developments. ### Source excerpt Explore the pivotal SSDF Security Self-Attestation Form, a key resource for CISOs to navigate and enhance security compliance. ## Threat Modeling and Secure by Design DevFeed: [Threat Modeling and Secure by Design]() Original publisher: [Read original article]() Author: Adam Published: 2023-07-19T00:00:00Z Content type: opinion Language: en Sources: [Shostack & Friends Blog]() Topics: [cisa]() Tags: [complex](), [secure-by-design]() ### AI overview The Threat Modeling Manifesto team published feedback to CISA responding to its Secure by Design Guidance. The feedback takes the form of a detailed letter, which was also covered by Infosecurity Magazine. ### Source excerpt Our feedback to CISA is now public ## Strengthening CI/CD Environments: Insights from NSA and DHS CISA guidance DevFeed: [Strengthening CI/CD Environments: Insights from NSA and DHS CISA guidance]() Original publisher: [Read original article]() Published: 2023-06-30T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [CI/CD](), [supply-chain-security](), [DevSecOps](), [Cybersecurity](), [cisa]() Tags: [chainguard-images](), [ci-cd](), [cicd](), [cisa](), [continuous-verification](), [cybersecurity](), [devsecops](), [secure-software-development-frameworks](), [security](), [sigstore](), [slsa](), [software-supply-chain](), [software-supply-chain-security](), [ssdf]() ### AI overview This commentary explains NSA and DHS CISA guidance for securing CI/CD environments. It highlights risks to downstream environments and software consumers, including compromised developer credentials and application libraries, and recommends established software supply chain security frameworks such as SLSA and CNCF best practices. ### Source excerpt Fortify your CI/CD environments with insights from NSA and DHS CISA guidance, presented by Chainguard. ## Government perspectives on software self-attestation requirements DevFeed: [Government perspectives on software self-attestation requirements]() Original publisher: [Read original article]() Published: 2023-06-15T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [cisa](), [Cybersecurity](), [chainguard](), [Security]() Tags: [chainguard](), [cisa](), [cybersecurity](), [fedramp](), [nist](), [open-source-security](), [regulatory](), [secure-by-design](), [security](), [self-attestation](), [software-supply-chain](), [software-supply-chain-security](), [ssdf]() ### AI overview Chainguard CEO Dan Lorenc and CISA Fellow Chris Hughes discuss CISA's draft software self-attestation form, its relationship to federal software supply chain security requirements, and the regulatory context surrounding secure software development. ### Source excerpt Chainguard CEO Dan Lorenc and Chris Hughes, CISO & Cofounder of Aquia and CISA Fellow discuss the upcoming software self-attestation form. ## Celebrating 5 years of NTIA's SBOM work DevFeed: [Celebrating 5 years of NTIA's SBOM work]() Original publisher: [Read original article]() Published: 2023-06-07T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [Cybersecurity](), [Security](), [chainguard](), [cisa](), [distroless]() Tags: [chainguard](), [cisa](), [cybersecurity](), [distroless](), [fedramp](), [openvex](), [sbom](), [software-bill-of-materials](), [software-dark-matter](), [software-supply-chain](), [software-supply-chain-security](), [sofware-supply-chain](), [ssdf](), [vex](), [vulnerability-scanning]() ### AI overview The article commemorates five years of the NTIA's Software Bill of Materials work and reviews the development of SBOMs as a foundation of software supply chain security. It describes the NTIA's initiative, its multi-stakeholder guidelines, and CISA's continuing role in advancing software transparency. ### Source excerpt Celebrate 5 transformative years of SBOM work with Chainguard, reflecting on the journey of software bill of materials. ## How to explain the CISA software attestation requirements to your board DevFeed: [How to explain the CISA software attestation requirements to your board]() Original publisher: [Read original article]() Published: 2023-05-05T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [cisa](), [cybersecurity and infrastructure security agency](), [software bill of materials](), [Security]() Tags: [attestation](), [chainguard](), [cisa](), [container-security](), [government](), [national-cybersecurity-strategy](), [nist](), [policy](), [sbom](), [sboms](), [secure-container-image](), [secure-software](), [self-attestation](), [signing-artifacts](), [sigstore](), [software-artifact-signing](), [software-bill-of-materials](), [software-supply-chain-security](), [ssdf]() ### AI overview This article explains how software companies can brief their boards on CISA software attestation requirements and the broader federal software supply chain security policy landscape. It discusses Executive Order 14028, SBOMs, secure software development, CISA's Secure Software Development Attestation Form, and the requirements in OMB Memorandum M-22-18, including alignment with NIST guidance. ### Source excerpt CISA's draft self-attestation form clarifies the minimum requirements that software developers must meet to comply with OMB Memorandum M-22-18.