CISA, NIST and NSA Publish Key Practices for Super Intelligence Incident Readiness

What's on the official record

CISA published "Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation" on 16 October 2026. The product was published jointly by the National Institute of Standards and Technology (NIST), the National Security Agency's Super Intelligence Security Center (NSA SISC), and CISA. It outlines ten voluntary core practices to help organizations that train and evaluate highly capable AI systems. The record names no CVE and carries no advisory identifier.

Assessment

For a platform or AI-stack owner, the record is a voluntary practices reference, not a patch directive. It lets you check whether your training and evaluation environments already implement the ten core practices CISA, NIST and the NSA SISC describe, and decide whether to adopt any missing ones before an incident occurs.

For a deal team, the record gives a diligence checkpoint rather than a price or condition signal. It lets you ask a target that trains or evaluates highly capable AI systems whether it has adopted the ten practices, and scope that answer into technical diligence on incident readiness.

What would change this call

CISA issuing a binding directive or an advisory identifier for these practices would move them from voluntary reference to enforceable requirement.

What to check next

Confidence

Filed 25 October 2026 from the record dated 16 October 2026.

Sources

[1] Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation — https://www.cisa.gov/resources-tools/resources/key-practices-incident-readiness-and-response-super-intelligence-training-and-evaluation