Published Tuesday, August 18, 2026 at 10:34 AM PT

<strong>DEVELOPING — Monitoring: CISA Seeks Public Input on Voluntary Vulnerability Assessment Program Extension</strong>

BLUF: CISA’s Infrastructure Security Division is soliciting public comment on an extension to its voluntary vulnerability assessment program for critical infrastructure organizations. Scope, timeline, and specific policy changes are unconfirmed at this stage. No immediate action required pending clarification of proposal details.

DETAILS:

  • CISA is actively seeking public comment on extending voluntary vulnerability assessments applicable to critical infrastructure operators.
  • The program extension remains under public comment period; final scope and requirements are not yet published.
  • This initiative aligns with CISA’s broader push for coordinated vulnerability disclosure and industry formalization of disclosure programs.
  • Context suggests focus on software vendors and infrastructure operators, but specific sector coverage is unconfirmed.
  • No deadline for public comment submission is confirmed in available material.

IMPACT:

  • Scope unclear. Critical infrastructure operators in energy, water, healthcare, and transportation sectors may be affected if extension applies across sectors, but current proposal does not delineate mandatory vs. voluntary participation.
  • Affected organizations: Software suppliers and critical infrastructure asset owners, scope to be clarified in published proposal.
  • Risk posture: Any extension that formalizes or mandates vulnerability assessments could shift operational burden on smaller operators or those with limited security staffing.

RECOMMENDED ACTIONS:

  • Monitor CISA channels (cisa.gov, Federal Register notices) for publication of the formal extension proposal.
  • If your organization operates critical infrastructure or supplies software to CI operators, prepare to review the proposal once public details emerge.
  • No action required until scope and requirements are published.

SOURCES:

  • CISA Infrastructure Security Division public comment solicitation (details insufficient; attribution to Industrial Cyber news feed)
  • Related CISA initiatives: coordinated vulnerability disclosure framework, vendor disclosure formalization urges

Recent high-severity events at publish time:

Recent high-severity events