CISA Issues V1 Emergency Directive on Cisco Device Compromise

CISA issued V1 of Emergency Directive 25-03, titled "Identify and Mitigate Potential Compromise of Cisco Devices," superseding the original ED 25-03 required actions. The directive applies to any federal agency running affected Cisco products and includes updated required actions as well as a new reporting requirement.

What Changed

V1 expands on the original ED 25-03 requirements with new mandatory steps for agencies. The exact technical actions are detailed in the directive document, but the key operational change is the addition of an explicit reporting obligation beyond the initial identification and mitigation steps. Agencies must now report findings to CISA as part of the compliance cycle.

Who Is Affected

All U.S. federal civilian executive branch agencies that operate affected Cisco devices are subject to this directive. While the order is binding only on federal agencies, the underlying vulnerability or compromise campaign may have broader implications for any organisation using the same Cisco products, including enterprises and service providers in India, UAE, and South Asia. Operators outside the U.S. should assess their own Cisco deployments against the indicators described in the directive.

Compliance Timeline

V1 takes effect immediately upon publication. Agencies must implement the updated required actions without delay. The reporting requirement must be fulfilled as specified in the directive. No grace period or phased rollout is indicated.

Operational Impact

Compliance teams running Cisco devices should review the full text of ED 25-03 V1, available at the CISA website, to identify the specific actions and technical indicators. For Indian, UAE, and South Asian operators not directly bound by CISA directives, this is a strong signal to proactively scan for signs of compromise on Cisco infrastructure and align with the mitigation steps. Monitor CISA for any further updates or threat intelligence related to this campaign.

Source: V1: ED 25-03: Identify and Mitigate Potential Compromise of Cisco Devices
Domain: cisa.gov