How to read a CISA ICS advisory and decide what to do about it

A CISA ICS advisory states the affected product and versions, the vulnerability, severity scores, vendor mitigations, and recommended practices. To triage one, match it against your inventory, check exposure and exploitation status, then schedule the vendor fix through your change process.

Where advisories come from

CISA publishes ICS advisories for vulnerabilities in industrial control system, OT and IoT products. Types include ICS Advisory (ICSA) and ICS Medical Advisory (ICSMA). IDs look like ICSA-26-280-01. The listing page shows thousands of entries and can be filtered by type, year, topic and vendor. Mitigation recommendations come from the product vendors.

Anatomy of one

Using a recent advisory as a pattern, the page contains:

1. Header with title, release date, alert code and a link to a machine readable CSAF file.
2. Summary with a box for CVSS, vendor, equipment and number of vulnerabilities.
3. Background on sectors, deployment and vendor location.
4. Vulnerability descriptions with CVE identifiers.
5. Affected products with version ranges and remediation.
6. Additional metrics: CWE, CVSS versions, scores and vector strings.
7. Acknowledgments.
8. Recommended practices and exploitation status.
9. Revision history.

Always read the revision history. Advisories get updated, and a fix version can change.

A triage routine

1. Match. Do you run the product and an affected version? Your inventory answers this.
2. Exposure. Is the product reachable from untrusted networks, or only inside a controlled zone?
3. Exploitation. The advisory says whether CISA knows of public exploitation. Cross check CISA's Known Exploited Vulnerabilities catalog.
4. Required access. The CVSS vector shows whether the attacker needs network access, privileges or user action.
5. Fix path. Note the vendor fixed version and the work to test it.
6. Compensating controls. If you cannot patch yet, tighten the network exposure the advisory recommends.

Reading the severity

A high CVSS score is not the same as high risk for your site. A flaw that needs a valid low privilege account on a gateway you keep isolated is a different problem from one reachable by anyone on the internet. The CISA inventory guidance suggests using the KEV catalog as authoritative input for prioritising vulnerabilities, alongside frameworks such as SSVC.

Make it routine

Subscribe to advisories for the vendors in your inventory. Review new ones weekly and record a decision for each, even when the decision is no action.

Click through it at your own pace, or open it full screen.

Record the decision

For each advisory, write one line: affected or not, exposure, action, date. In an audit or after an incident, that log shows the reasoning was sound even when the action was to wait.

Quick check

Sources

• CISA, ICS Advisories listing
• CISA, example ICS advisory page ICSA-26-286-01
• CISA, Foundations for OT Cybersecurity: Asset Inventory Guidance

Last reviewed: 19 October 2026.