CISA Binding Operational Directive 23-02 tells US federal civilian agencies to take internet-exposed management interfaces such as routers, firewalls and VPN gateways off the internet or put access control in front of them within 14 days. It binds agencies only, but its two options are useful for any organisation.
What the directive says
According to CISA's page, agencies must take one of two actions within 14 days of CISA notification or the agency's own discovery. The first is to remove the interface from the internet by making it accessible only from an internal enterprise network. The second, which CISA describes as preferred, is to deploy capabilities, as part of a Zero Trust Architecture, that enforce access control to the interface through a separate enforcement point.
Agencies must also make sure all in-scope interfaces, on both existing and newly added devices, have one of those protections.
What is in scope
The directive covers routers, switches, firewalls, VPN concentrators, proxies, load balancers and out-of-band server management interfaces. It applies when the interface uses a remote management protocol over the public internet. Cloud service provider web applications and APIs are excluded.
Who it applies to
Federal civilian agencies. It is not a rule for private companies, and this article is not legal advice. Private organisations can still read it as a clear statement of good practice.
What a private company can borrow
- Find them. List every device that has a management login. Check which ones answer from outside.
- Pick one of the two fixes. Either move the interface to an internal network, or require access through something that enforces authentication before the interface is reachable, such as a VPN or an access proxy that checks identity.
- Do it for new devices too. Add the rule to your build checklist so a new router does not repeat the old mistake.
- Set a deadline. The 14 day window is a useful default for a high-risk finding.
Why management interfaces get special treatment
These pages control the device that protects the network. If an attacker reaches a login on a firewall with a weak or default password, or an unpatched flaw, they may control the edge itself. They are also easy to forget, since they are set up once and rarely looked at.
A quick audit
- Search your own address ranges for open management ports and login banners.
- Review cloud security group rules for broad allow entries on admin ports.
- Check out-of-band server management has its own network and strong credentials.
- Confirm firmware is current and that the vendor still supports it.
Document exceptions. Some devices cannot be moved behind an access layer immediately. Record the reason, the compensating controls such as an allow list and strong authentication, the owner and a review date.
Where Safeguard fits
Safeguard does not scan network devices. For software you build, it provides policies, gates and dependency scanning. Pair a network check from this article with those if you run both.
Quick check
Is BOD 23-02 mandatory for my company?
No. It applies to federal civilian agencies. Companies can adopt the practice voluntarily, though contract terms may reference similar controls.
Sources
Last reviewed: 19 October 2026.
