CISA Issues Binding Operational Directive (BOD) 23-01 to Improve Cybersecurity Asset Visibility and Vulnerability Detection

Yesterday, the Cybersecurity and Infrastructure Security Agency (CISA) announced a new Binding Operational Directive (BOD) 23-01, Improving Asset Visibility and Vulnerability Detection on Federal Networks. The intent of the BOD is to help federal agencies strengthen their cyber defenses by gaining visibility into all the assets on their networks and improving vulnerability detection capabilities.

The requirements of this Directive focus on two core activities essential to improving operational visibility for a successful cybersecurity program: asset discovery and vulnerability enumeration. According to CISA, “Discovery of assets and vulnerabilities can be achieved through a variety of means, including active scanning, passive flow monitoring, querying logs, or in the case of software defined infrastructure, API query. Many agencies’ existing Continuous Diagnostics and Mitigation (CDM) implementations leverage such means to make progress toward intended levels of visibility.” This BOD is binding for Federal agencies, but all organizations – private businesses, industry, and state, local, tribal and territorial (SLTT) governments – are strongly encouraged to review and implement recommendations from this guidance.

“Threat actors continue to target our nation’s critical infrastructure and government networks to exploit weaknesses within unknown, unprotected, or under-protected assets,” said CISA Director Jen Easterly. “Knowing what’s on your network is the first step for any organization to reduce risk. While this Directive applies to federal civilian agencies, we urge all organizations to adopt the guidance in this directive to gain a complete understanding of vulnerabilities that may exist on their networks. We all have a role to play in building a more cyber resilient nation.” Read the Binding Operational Directive at CISA.