Qualys Responds to CISA Alert: Binding Operational Directive 23-02 | Qualys
Summary: CISA released Binding Operational Directive 23-02, "Mitigating The Risk From Internet-Exposed Management Interfaces," on June 13, 2023, requiring agencies to inventory, identify, and manage digital assets and to act within 14 days of notification or discovery of a networked management interface. The directive also requires technical or management controls so that all management interfaces on existing and newly added devices carry at least one of the specified protections, and it extends to agency supply chain partners.
Bottom line: The 14-day clock starts on notification or agency discovery of an exposed management interface, and the directive reaches beyond federal agencies to their supply chain partners, so vendors and contractors inherit the same exposure question.
Read the original at Qualys Blog ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026