News & Events

CISA issued Emergency Directive (ED) 25-02 in response to a newly disclosed vulnerability affecting Microsoft Exchange hybrid-joined configurations.

CISA has concluded that the intended purposes of ED 24-02 has been met and has therefore sunset this ED and all required actions mandated.

This Directive complements existing federal resources for cloud security, including the Federal Risk and Authorization Management Program (FedRAMP), relevant NIST guidance, and the CISA Trusted Internet Connections (TIC) 3.0 Cloud Use Case.

This Directive requires agencies to take steps to reduce the attack surface created by insecure or misconfigured management interfaces across certain classes of devices.