10 emergency directives retired as CISA declares them redundant

• CISA retired ten Emergency Directives, citing successful implementation or redundancy under BOD 22-01
• BOD 22-01 mandates agencies patch known exploited vulnerabilities (KEVs) within strict deadlines
• This marks the largest simultaneous ED retirement, reinforcing CISA’s Secure by Design principles

The US Cybersecurity and Infrastructure Security Agency (CISA) retired ten Emergency Directives (ED) it issued between 2019 and 2024, saying they achieved their purpose and are no longer needed.

In a short announcement published on its website, CISA said the EDs have either been successfully implemented or are now encompassed through Binding Operational Directive (BOD) 22-01, making them redundant.

“When the threat landscape demands it, CISA mandates swift, decisive action by Federal Civilian Executive Branch (FCEB) agencies and continues to issue directives as needed to drive timely cyber risk reduction across federal enterprise,” said CISA Acting Director Madhu Gottumukkala.