By Brandon Hancock, J.D., CMMC-RP
CISA issued Emergency Directive 26-03 on February 25, 2026, directing federal agencies to address vulnerabilities in Cisco SD-WAN systems. The directive is aimed at agencies, but contractors should not ignore it. If a contractor operates, supports, administers, or connects to affected federal environments, the practical burden can reach the contractor quickly.
Why emergency directives matter beyond agency networks
CISA emergency directives are binding on federal civilian executive branch agencies. They are not automatically clauses in every contract. But federal networks are often built, maintained, monitored, and supported by contractors. When an agency must act quickly, it may rely on contractors for discovery, patching, configuration review, threat hunting, log collection, documentation, and status reporting.
That means an agency-only directive can become a contractor-performance event. The contractor may receive a task order, service ticket, urgent change request, or customer instruction requiring rapid action. A managed service provider may need to produce asset inventories. A cloud or network vendor may need to show whether affected products are in use. A systems integrator may need to coordinate remediation windows.
Vulnerability management is evidence management
The important lesson is not limited to Cisco SD-WAN. Emergency directives expose whether the contractor's vulnerability-management program is operational. Can the contractor identify affected assets quickly? Can it determine whether those assets support federal work? Can it document version status, exposure, compensating controls, and remediation timing? Can it preserve logs and support hunting activity?
A vulnerability-management program that exists only as a monthly scan report may not be enough. During an emergency directive, the agency may need a faster, asset-specific answer.
What this means for government contractors
Contractors should classify agency directives into three buckets.
First, directives that apply directly to systems the contractor operates on behalf of an agency. Those require immediate contract and technical coordination. Second, directives that affect agency systems the contractor connects to or supports. Those may require access changes, configuration validation, or customer communications. Third, directives that do not apply to a contractor system but reveal a risk relevant to the contractor's own environment. Those should still inform internal remediation priorities.
The contractor should also consider whether a vulnerability event creates separate reporting obligations. If exploitation is suspected, the team may need to review DFARS, agency reporting instructions, subcontract notice provisions, and cyber-insurance requirements.
Do not wait for the customer to ask for inventory
The most common delay is not patching. It is figuring out whether the company is affected. Contractors should maintain a product and service inventory that can answer: do we use this technology, where, for which customer, and who owns remediation?
That inventory should include devices and services operated by subcontractors and managed service providers. If a contractor relies on a third party to manage network infrastructure for federal work, the contract with that third party should require timely vulnerability notices and remediation evidence.
Next step: create an emergency-directive playbook
Build a short playbook with these steps:
1. Identify whether affected technology is used in any federal-supporting environment. 2. Map affected assets to contracts, customers, and system owners. 3. Determine exposure and current version status. 4. Preserve relevant logs before making disruptive changes. 5. Apply vendor guidance and agency direction. 6. Record remediation evidence. 7. Review whether incident-reporting or customer-notice obligations are triggered. 8. Capture lessons learned for the asset inventory.
That playbook will help with the next directive, not just this one.
Sources
- ED 26-03: Mitigate Vulnerabilities in Cisco SD-WAN Systems, Cybersecurity and Infrastructure Security Agency, February 25, 2026.
- Supplemental Direction ED 26-03: Hunt and Hardening Guidance for Cisco SD-WAN Systems, Cybersecurity and Infrastructure Security Agency, February 25, 2026.