CISA defines zero trust as a continuous verification model rather than a single product, yet implementation is hindered by bureaucratic spending rules. With over one-third of staff laid off since January 2025, the agency faces reduced capacity to enforce security across critical infrastructure.
CISA extended the CIRCIA rulemaking deadline to May 2026, with an administrative target of September 2026. Jeff Greene and Mike Duffy lead the agency as it addresses stakeholder concerns over the 72-hour reporting window and a projected $2.6 billion cost.
CISA's new Binding Operational Directive 26-04 replaces fixed deadlines with a risk-based model, mandating three-day remediation for high-risk vulnerabilities like CVE-2026-19868. The shift addresses AI-accelerated threats but strains agencies, as only 26% of KEVs were fully remediated in 2025.
