CISA close to issuing new cyber AI directive

The Cybersecurity and Infrastructure Security Agency (CISA) is preparing to release its first binding operational directives (BODs) by Friday to help federal agencies secure large language models and integrate AI into cyber defense strategies. This move follows President Donald Trump’s executive order on artificial intelligence, signed Tuesday, which mandates CISA to issue guidance within 30 days to prioritize cyber defense for civilian federal systems. The directives will also establish or expand federal cybersecurity programs and services that enhance AI-driven defensive tools. CISA will facilitate access to cybersecurity tools—including frontier AI models—for agencies, state and local authorities, and critical infrastructure operators such as rural hospitals, community banks, and utilities. Acting CISA Director Nick Andersen announced the plans during a speech at the TechNet Cyber conference, emphasizing the need for modernized, AI-native capabilities to address evolving cyber threats. He highlighted efforts to streamline vulnerability remediation and risk management across federal systems, aligning industry and government approaches for a more resilient cybersecurity framework. The BODs mark a shift toward adaptive, risk-based cybersecurity systems, moving away from traditional data collection methods. Yejin Jang, vice president of government affairs at Abnormal AI, noted that AI tools will provide better data for protecting technology environments, while Gary Barlet, Illumio’s public sector CTO, stressed the importance of containment over detection in mitigating breaches. CISA’s directives aim to ensure that federal agencies and critical infrastructure operators can respond swiftly to cyber threats, limiting lateral movement and preventing mission-wide disruptions. The agency declined to provide further details on the specific measures included in the directives.