What Did FedRAMP Require for Cisco SD-WAN Under Emergency Directive 26-03?

FedRAMP’s notice says the response was mandatory for cloud service providers in the FedRAMP Marketplace and was issued in response to CISA Emergency Directive 26-03. Providers had to review the directive, identify all in-scope affected systems within their FedRAMP-authorized boundary, and, if no affected systems were found, skip to the final reporting step. Where affected systems existed, FedRAMP said providers should collect logs, apply Cisco-provided updates to the CVEs named in the directive, and perform the hunt and hardening activities recommended in the supplemental guidance. Providers also had to upload supplemental information to the Incident Response folder, notify agency customer Authorizing Official or ISSO points of contact, and complete FedRAMP’s Emergency Directive 26-03 Response Form. FedRAMP noted that the February 27, 2026 deadline came from CISA, not FedRAMP, and that Security Inbox corrective actions did not apply to this notification, although incident response or continuous monitoring deficiencies could still trigger corrective actions.