Guidance, practices and programmes
CISA catalogs and directives
The Known Exploited Vulnerabilities catalog, binding directives and baseline performance goals.
Official source Published by US Cybersecurity and Infrastructure Security Agency. US government work.
What it is
CISA, the US Cybersecurity and Infrastructure Security Agency, publishes catalogues, directives and goals that set expectations for US federal agencies and give guidance to everyone else. The most widely used is the Known Exploited Vulnerabilities (KEV) catalogue, a list of vulnerabilities confirmed as exploited in the wild.
Who it applies to
- US federal civilian executive branch agencies, which must follow Binding Operational Directives and Emergency Directives
- US critical infrastructure operators, which use the Cross-Sector Cybersecurity Performance Goals
- Vulnerability management teams worldwide, which use the KEV catalogue to prioritise patching
- European organisations, which commonly use KEV and CISA advisories as threat input although the directives do not bind them
- Status
- Directives are binding US federal policy for federal civilian agencies only; the KEV catalogue began in 2021 under Binding Operational Directive 22-01. The performance goals and advisories are voluntary guidance.
- Enforcement
- CISA oversees agency compliance with its directives. For everyone else, the catalogues and goals are voluntary, though they increasingly appear in contracts, insurance questionnaires and auditors' expectations.
Key points
- KEV is a strong prioritisation signal: a listed vulnerability is being exploited, whatever its CVSS score
- Use KEV alongside exploit prediction scores and your own exposure, not as your only patch list
- Emergency Directives are a good indicator of the most serious current threats
- Joint advisories with European and other partner agencies often include ATT&CK mapped attacker behaviour and indicators
- Secure by Design guidance sets expectations for software makers that overlap with the EU Cyber Resilience Act
Where to start
- 1Subscribe to the KEV feed and CISA advisories
- 2Match KEV entries against your asset and vulnerability data and set internal remediation deadlines
- 3Use the performance goals as a quick self check of baseline practices
- 4Track Emergency Directives as triggers for urgent checks in your own environment
How it is structured
| Known Exploited Vulnerabilities catalogue | Vulnerabilities with evidence of active exploitation and remediation due dates for agencies |
|---|---|
| Binding Operational Directives | Standing requirements for federal agencies, such as KEV remediation and asset visibility |
| Emergency Directives | Urgent instructions for specific threats |
| Cross-Sector Cybersecurity Performance Goals | A short set of baseline practices for critical infrastructure |
| Advisories and Secure by Design guidance | Joint advisories with partner agencies and guidance for software makers |
A plain-language overview to help you learn, written by ThreatNoir. The official source prevails; this is not legal advice.
Items explained (3)
Ordered by how often our lessons cite them.