Every GovConFeed story on CISA — contract awards, policy, enforcement, and protests, newest first.
Most cyber-defense deliverables in Executive Order 14409 come due July 2, 2026, putting CISA Binding Operational Directives, a Treasury-led AI vulnerability clearinghouse, and risk-based patch timelines on a 30-day clock that reshapes obligations for federal contractors.
Read the story →Under EO 14409, the administration cleared Anthropic’s Mythos 5 for limited deployment and restricted OpenAI’s GPT-5.6 to roughly 20 approved customers — the first use of a government gate that puts frontier AI before federal buyers ahead of commercial release.
OMB's M-26-15, issued June 24, 2026, turns Executive Order 14412 into execution milestones: contractors must meet post-quantum FIPS by end of 2030, and CISA and NIST must publish minimum elements for a Cryptographic Bill of Materials within 270 days.
A GAO report found federal cloud spending has surpassed $10B annually, but 24 agencies face outdated FAR definitions, conflicting OMB-NIST guidance, and a retired spending data system. GAO issued recommendations to GSA, DHS, CISA, and the Federal CIO Council, and presented two matters for congressional consideration.
Senator Warner demanded CISA org charts from three time points, warning Trump-era workforce cuts—leaving five of ten regional directors in acting roles and eliminating MS-ISAC funding—have weakened state and local cyber support ahead of November midterms. House Appropriations approved $2.35B for CISA in FY2027, $253M below FY2026.
CISA reset its canceled CIRCIA stakeholder town halls to four virtual sessions June 15-18, 2026, with the June 18 meeting covering the Defense Industrial Base. It is likely industry's last chance to shape the cyber-incident-reporting rule before it is finalized.
OMB Director Russ Vought issued M-26-14, rescinding Biden-era M-21-31 logging requirements. The new memo shifts agencies to continuous event monitoring and threat-hunting frameworks, with CISA given 90 days to publish a Logging Reference Architecture and compliance deadlines stretching to 320 days.
CISA launched CI Fortify on May 5-6, 2026 — a new initiative requiring critical infrastructure operators to plan for isolation-mode operations and manual recovery from cyberattacks. ICS/SCADA vendors, MSPs, and security integrators are explicitly called out as essential partners.
On January 8, 2026, CISA announced the retirement of 10 emergency directives issued between 2019-2024. The retirement signals a shift toward targeted, threat-specific guidance over sweeping standing directives — with implications for how contractors respond to future cybersecurity requirements.
The Department of Homeland Security moved to its Cumulus centralized cloud vehicle with non-competitive block-one awards to the four major hyperscalers. Contracts have 1-year base periods and up to four option years. Financial details redacted. Small firms should pay attention to the downstream services layer.
One free morning email when we publish. Read it in three minutes, act before your competitors do.
You're in. ✓
Check your inbox to confirm your subscription.No spam. Unsubscribe any time. Read our privacy policy.
