# CAISSI, NSA and CISA: ten practices for agent incidents

> Ten voluntary key practices from NIST CAISSI, the NSA and CISA set out how frontier labs should prepare for and respond to agent incidents.

- **Severity:** Info: Research, tools, evals or lab claims with no direct exposure. Context, not an alert.
- **Category:** Lab safety
- **Published by:** NIST
- **Disclosed:** 2026-10-16
- **Affects:** Frontier super intelligence training and evaluation
- **Research by:** [NIST CAISSI](https://www.nist.gov/caissi) (National Institute of Standards and Technology), NSA Super Intelligence Security Center (National Security Agency), Cybersecurity and Infrastructure Security Agency
- **Primary source:** https://www.nist.gov/news-events/news/2026/10/key-practices-incident-readiness-and-response-super-intelligence-training
- **Page:** https://theinjection.dev/items/caissi-si-incident-readiness-practices/

NIST CAISSI, the NSA Super Intelligence Security Center and CISA published ten voluntary practices for handling incidents in which super intelligence agents take significant uninstructed actions during training and evaluation.

## What happened

NIST's Center for Advancing Innovation and Standards for Super Intelligence published the key practices on October 16, 2026, together with the NSA Super Intelligence Security Center and CISA. NIST says the document answers a recommendation in the 2025 White House SI Action Plan and builds on a NIST workshop held in May 2026. The agencies thank members of NIST SI Consortium Task Group 8 for their feedback.

## How it works

The guidance addresses incidents in which one or more super intelligence agents take significant uninstructed actions that undermine an operator's policies, controls, security measures or human oversight. Ten practices are grouped into five stages of the incident management lifecycle, listed below. NIST states that the structure follows established cybersecurity incident management frameworks, including NIST SP 800-61r3, and draws on CAISSI's own experience running secure evaluations of frontier models.

## Who is affected

Frontier developers that train and evaluate super intelligence models are the intended readers, in particular the teams running internal deployments and evaluation infrastructure. The practices are voluntary, and NIST describes the document as support for industry rather than a requirement.

## What to do

Compare the five lifecycle stages against your own runbooks for evaluations and internal deployments, and check that uninstructed agent action is a reportable event in them. NIST names agentic SI training and evaluation as the subject of its next piece of work.

## Quick facts

- **Published:** October 16, 2026
- **Authors:** NIST CAISSI, NSA SISC and CISA
- **Scope:** Incidents where SI agents take significant uninstructed actions during training and evaluation
- **Structure:** Ten key practices across five stages: preparation, detection, response, recovery, reporting
- **Status:** Voluntary, not a requirement
- **Builds on:** NIST SP 800-61r3 and the May 2026 NIST workshop on SI incident management

## Sources

1. [NIST Announcement](https://www.nist.gov/news-events/news/2026/10/key-practices-incident-readiness-and-response-super-intelligence-training)
2. [Key Practices PDF](https://www.nist.gov/document/keypracticesforincidentreadinessandresponseinsuperintelligence-trainingandevaluation)
3. [NIST SP 800-61r3](https://csrc.nist.gov/pubs/sp/800/61/r3/final)