The Cybersecurity and Infrastructure Security Agency (CISA) has published new guidance aimed at helping critical infrastructure organizations detect, observe and impede malicious cyber activity, according to the announcement on CISA's website.

The headline gives the audience and the goal. It does not give much else, and the feed that carried the announcement did not include a summary. So the honest report at this stage is short: CISA has a new document, it is directed at critical infrastructure operators, and it is organized around three verbs. Detect, observe, impede.

What is not yet confirmed from the announcement title alone: the length and format of the document, whether it was co-sealed with other agencies or international partners, whether it targets a specific sector or all sixteen critical infrastructure sectors, whether it is aimed at IT environments, operational technology, or both, and whether it includes concrete detection logic, configuration baselines or checklists. Anyone quoting specifics from it should read the document itself rather than this article.

The word choice is worth a moment. "Impede" is not "prevent" or "block." It's a modest verb, and that is probably the point. It is about as close as a government agency gets to saying, in print, that the attacker is going to get in eventually, so the job is to see them quickly and make their life miserable once they are inside. That is a more realistic framing than most vendor slide decks manage, and it happens to be the framing identity teams already work under.

CISA is not a regulator for most sectors, and its guidance is typically voluntary unless a sector-specific regulator adopts or references it. Nothing in the announcement title indicates a mandate, deadline or penalty, and none should be assumed. Operators who fall under regulators that do lean on CISA publications (which several do) should watch for whether this document gets cited downstream.

Even without the body text, the three verbs map cleanly onto controls that already exist in CISA's public catalog. The Cross-Sector Cybersecurity Performance Goals (CPGs) call out phishing-resistant MFA, separation of user and privileged accounts, revocation of credentials for departing staff, and collection and retention of security logs. CISA's Zero Trust Maturity Model, built on NIST SP 800-207, treats identity as its first pillar. If the new guidance is consistent with those earlier documents, and CISA guidance tends to be, identity will be on the critical path for all three verbs.

Detection depends on logs that actually record authentication events, privilege changes and service account activity. Observation depends on those logs being retained long enough to matter and being readable by someone who is looking. Impeding depends on the boring controls: least privilege, MFA that cannot be phished, conditional access that says no, and network segmentation so a stolen credential does not open every door at once.

The encouraging part is that none of this requires waiting for the document. Most critical infrastructure operators already know where their gaps are. Shared local admin accounts on plant floor workstations, domain admin groups with more members than the org chart can explain, service accounts with passwords last rotated when a different administration was in office. A new PDF will not fix any of that. It might, however, give a security lead the cover to finally ask for the budget.

For now, the report is: new guidance exists, it is aimed at critical infrastructure, it is built around detection, observation and impeding, and the details are in the document rather than the announcement. This article will be updated or followed up once the full text has been reviewed.

What identity and security teams should check: pull the document and compare its detection and logging expectations against what your identity provider and directory are actually emitting, especially for privileged accounts and service accounts, because a control that is not logged cannot be detected or observed. Confirm that your MFA deployment covers remote access and administrative interfaces with phishing-resistant methods rather than SMS or push. Then run the least glamorous test available: pick one stale service account and try to trace what it can reach. If the answer is "more than anyone expected," you have found the first thing to impede.