Compliance / CISA
CISA Directives & Post-Quantum Initiative
The CISA channel carries 7 rules curated from CISA's Post-Quantum Cryptography Initiative (Strategic Plan FY2024-2026) and Binding Operational Directive 18-01: the removal of weak protocols and ciphers from federal services and the migration path toward quantum-resistant cryptography. Rules are tagged against FIPS 140-3 and BOD 18-01.
What the directives demand
- BOD 18-01: legacy SSL/TLS versions and weak ciphers such as RC4 and 3DES removed from federal-facing services
- PQC Initiative: inventory of quantum-vulnerable cryptography as the first migration step, aligned with the NIST FIPS 203 / 204 / 205 standards
- Strategic Plan FY2024-2026: agencies expected to know where vulnerable cryptography lives before replacement budgets land
The Korthex CISA channel
7 hand-curated rules re-checked on the 24-hour cycle, shipped as signed updates, co-tagged FIPS 140-3 so a CISA-graded finding also lands in FIPS-facing evidence. The recommended US Federal activation profile is the NIST channel plus this one: NIST supplies the approved-algorithm baseline, CISA supplies the directive-specific removals and PQC-readiness posture.
The quantum-vulnerability inventory the initiative asks for is exactly what the CBOM produces: every RSA, ECC and Diffie-Hellman usage with file, line, reachability and its FIPS 203 / 204 / 205 successor.
Frequently asked questions
Who should activate the CISA channel?
US federal agencies, FedRAMP-facing vendors and anyone aligning with CISA's PQC migration guidance. The recommended profile pairs it with the NIST channel.
Does Korthex produce the PQC inventory CISA asks for?
Yes. The CBOM lists every quantum-vulnerable primitive with location and successor mapping, which is the inventory step both CISA and NIST IR 8547 define as the migration's start.
Is BOD 18-01 only about web services?
The directive targets federal-facing services, but the underlying weak-protocol rules (RC4, 3DES, legacy SSL/TLS) apply to any TLS configuration Korthex scans, so the channel flags them wherever they appear.