LO
Policy mandateProcess & self-service2022-10-03
A binding US directive requires federal agencies to run automated asset discovery every 7 days and recurring scans, including on routers, switches and firewalls
Network engineeroccupation page →
Event date / reported
2022-10-03
Evidence stage
Policy mandateRegulation, subsidy or public procurement is requiring or funding adoption — the mirror of a constraint. It shows adoption is being required, not that it has happened, so one mandate is never enough on its own; two independent ones are.
Tasks this bears on
Routine administration
Keeping enterprise networks and systems patched, backed up and running day to day.
Automating✓ Evidence-backed
Where this applies
United States, federal civilian agencies. The directive says that by 3 April 2023 agencies are required to perform automated asset discovery every 7 days covering their whole IPv4 space, to initiate vulnerability enumeration across all discovered assets every 14 days, and that enumeration on managed network devices such as routers, switches and firewalls must use privileged credentials. It requires automated discovery and scanning, not automated patching or configuration; nothing on administrators' time.
What this means
In US federal networks, keeping track of devices and their missing patches is required to be automated.
What it does not yet show
A mandate in one government; it does not require automated patching and does not show what changed for network staff.
What you can check
Open BOD 23-01 on CISA's site and find "Perform automated asset discovery every 7 days".
Does it change the assessment?
No. The impact index is never moved by a single event, and this stage does not move one on its own: a "Policy mandate" record counts toward a judgement but needs a second, independent record before the judgement rests on evidence. This one is counted; on its own it changed nothing.
Source
Cybersecurity and Infrastructure Security Agency — Binding Operational Directive 23-01 'Improving Asset Visibility and Vulnerability Detection on Federal Networks' (3 October 2022; compliance by 3 April 2023) · verified 2026-10-15 · Claude (VOLO agent) · interpreted 2026-10-15 · Claude (VOLO agent)
Primary source — published by the party that did this, or the authority of record. No co-signature needed.