Cybersecurity Database

Directive

BOD 16-02 – Threat to network infrastructure devices

Binding Operational Directive 16-02: Threat to Network Infrastructure Devices

In force since 27 September 2016Record checked against the official source on 2 November 2026 · Methodology

Official source: https://www.cisa.gov/news-events/directives/bod-16-02-threat-network-infrastructure-devices

Official source
Official number
BOD 16-02
Date adopted
Entry into force

Summary

Binding operational directive issued by the Department of Homeland Security on 27 September 2016 under FISMA, because network infrastructure devices have become a preferred attack vector for sophisticated threat actors. It names three urgent issues, described in NCCIC Analysis Report AR-16-20173 and its Technical Annexes: hacking tools targeting firewalls, Cisco Adaptive Security Appliances and Cisco ROM Monitor integrity. The vulnerabilities in the report are deemed critical for the purposes of BOD 15-01. Within 45 days federal agencies had to perform all actions in the "Solution" sections of the Technical Annexes and report to DHS, through the OMB MAX Connect portal, either full mitigation or a plan of action with compensating controls, then report every 30 days until fully mitigated. The same deadlines apply to any future Technical Annex, from its issuance date.

Who it applies to

Federal executive branch departments and agencies. National security systems and certain Department of Defense and intelligence community systems are excluded.

Key dates

  1. Within 45 days: actions in the AR-16-20173 Technical Annexes performed and full mitigation or a plan of action reported to DHS, then reports every 30 days

Information

Jurisdiction
United States
Issuing body
Department of Homeland Security
Type
Directive
Available languages
English
Topics
Notes
The 45-day deadline date is calculated from the issuance date: the page gives only the number of days. NCCIC also deployed EINSTEIN signatures to detect related suspicious activity. In case of non-compliance DHS follows up with the agency's Deputy Secretary or equivalent. BOD 15-01, to which the directive refers, was later revoked by BOD 19-02. As of 2 November 2026 the CISA page does not mark the directive as revoked.

Record details

Original title
Binding Operational Directive 16-02: Threat to Network Infrastructure Devices
Title in other languages
  • Direttiva operativa vincolante 16-02: minaccia ai dispositivi dell'infrastruttura di rete
  • Directive opérationnelle contraignante 16-02 : menace visant les équipements d'infrastructure réseau
  • Directiva operativa vinculante 16-02: amenaza para los dispositivos de infraestructura de red
  • Verbindliche operative Richtlinie 16-02: Bedrohung von Netzwerkinfrastrukturgeräten
Licence / terms of use
Public domain / official act – Work of the United States federal government (17 U.S.C. § 105).
Collected from
manual entry
Last verified
(verified via web)

How to cite

APA

Department of Homeland Security. (2016). Binding Operational Directive 16-02: Threat to Network Infrastructure Devices (BOD 16-02). https://www.cisa.gov/news-events/directives/bod-16-02-threat-network-infrastructure-devices

Chicago

Department of Homeland Security. "Binding Operational Directive 16-02: Threat to Network Infrastructure Devices." 27 September 2016. https://www.cisa.gov/news-events/directives/bod-16-02-threat-network-infrastructure-devices.

BibTeX

@misc{us_bod_16_02_network_infrastructure_devices_2016,
  author       = {{Department of Homeland Security}},
  title        = {{Binding Operational Directive 16-02: Threat to Network Infrastructure Devices}},
  year         = {2016},
  note         = {BOD 16-02},
  url          = {https://www.cisa.gov/news-events/directives/bod-16-02-threat-network-infrastructure-devices},
  urldate      = {2026-11-02}
}

Metadata and summary: CC BY 4.0 · JSON