Cybersecurity Snapshot: CISA’s Best Cyber Advice on Securing Cloud, OT, Apps and More

This Cybersecurity Snapshot compiles CISA guidance from the past 12 months, emphasizing best practices across six areas: selecting secure OT products, implementing and using SBOMs, secure software development, lessons from a CISA red team assessment, implementing secure cloud practices (including BOD 25-01), and adopting a consistent enterprise security posture via the FOCAL plan. The report highlights common vulnerabilities—such as use of valid compromised accounts, phishing, default credentials, and inadequate logging or segmentation—and recommends mitigations including phishing-resistant MFA, asset inventories, timely patching, network segmentation, secure development practices, centralized logging, and vendor procurement criteria to improve supply-chain and product security.