CISA to transform how it assesses cyber vulnerabilities and risks, Andersen says

The Cybersecurity and Infrastructure Security Agency (CISA) is issuing a binding operational directive to change federal vulnerability management: moving from a blanket "apply patches immediately" stance to a risk-based, "fine grade" approach that prioritizes internet-exposed assets, known exploited vulnerabilities, and automatable exploits; the agency will also work with critical infrastructure operators to focus on the most critical functions, consider shortening patching windows, and is hiring staff to bolster its capabilities.