Read an advisory in layers: first the summary, then mitigations, then hunt guidance, then indicators. Convert each into a ticket with an owner and a done condition. Five good tasks beat a printed PDF. The CISA Volt Typhoon advisory makes a useful worked example.
Step 1: read for structure
Advisories from CISA and partners usually have the same bones: a summary, technical details, detection advice, mitigations and indicators. The Volt Typhoon advisory (AA24-038A) was released on 7 February 2024 by CISA, the NSA, the FBI and partners including agencies in Australia, Canada, the UK and New Zealand.
Skim the headings first. Decide which sections apply to you before reading deeply.
Step 2: sort statements into three bins
- Do now: configuration or patching you control.
- Check: logs or settings to inspect.
- Know: background for leadership.
Step 3: write five tasks
From the advisory, here are five that fit most organisations.
Task 1: edge inventory and patch status. The advisory says the group gets in mainly through flaws in routers, VPNs and firewalls. Done when every internet-facing device is listed with an owner and a patch date.
Task 2: remove stored credentials from appliances. The advisory says not to store credentials on edge devices. Done when configurations were checked and any found were rotated.
Task 3: admin account review. The advisory recommends limiting privileged accounts and separating user and admin accounts. Done when the admin list is reviewed and users no longer browse from admin accounts.
Task 4: log availability check. The advisory recommends keeping application, access and security logs on, centrally stored. Done when central ingestion is confirmed for VPN, identity and domain controllers.
Task 5: one hunt. The advisory suggests, for example, investigating all Event ID 1102 entries and reviewing unexpected remote desktop sessions. Done when a person ran the searches, wrote down the result and saved the queries.
Step 4: give each a date and an owner
A task with no owner is a wish. Set a date within a quarter at most, and review on that date.
Step 5: decide what you will not do
Write down items you are skipping and why, for example "no ICS systems, so ICS guidance is out of scope". That record is useful for audits and for your future self.
Step 6: close the loop
When the tasks are done, note the advisory name and date in your register. When a newer advisory appears, compare it with your record and add only what is new.
What not to do
Do not paste long indicator lists into blocklists without checking age and source. Indicators go stale quickly, and behaviours last longer.
Quick check
Do I have to implement every recommendation in an advisory?
No. Pick those that fit your environment, and record what you skip and why.
How many tasks is right?
Few enough to finish. Five owned tasks done this quarter beat thirty open ones.
Sources
Last reviewed: 19 October 2026.
