The watch · Last checked 12 October 2026

CISA advisories, only for what you own.

The short answer

CISA publishes industrial control system advisories and additions to its Known Exploited Vulnerabilities catalog on its website, by RSS and by email. All of it is free. The trouble is volume: the ICS advisory page held 4,193 advisories on 12 October 2026, and the feeds carry every maker, not yours.

Sign up with the makers and models you run and we’ll set you up within a week; you’ll get advisories matched to the equipment you list. It is free. If you want the rest of the record watched as well, that is the watch.

General information, not legal advice. Checked against the primary sources listed at the foot of this page on 12 October 2026. Rules change; confirm against the source before you rely on it.

What CISA publishes

  • ICS advisories (ICSA). Newly disclosed vulnerabilities in industrial control systems and related operational technology, with the affected products and versions, the details and the mitigations. Published at cisa.gov/news-events/ics-advisories.
  • ICS medical advisories (ICSMA). The same for medical devices and the systems that support them.
  • Known Exploited Vulnerabilities. Flaws with reliable evidence of active exploitation and a clear fix. See our KEV guide.
  • Machine-readable advisories. CISA publishes its advisories in the CSAF 2.0 format in the cisagov/CSAF repository, as a trusted provider.

To receive them, CISA offers RSS feeds (including one for ICS advisories and one for ICS medical advisories) and email updates by topic through its subscription page. In May 2025 CISA announced it would move routine updates off its advisories page, then paused the change the next day to reassess; check the subscription page for the current channels.

Why owners miss the ones that matter

  • Volume. Several ICS advisories can appear in a single day, across hundreds of makers. Most are about equipment you do not have, so the one that is about yours gets skimmed past.
  • Names do not match. An advisory names the maker’s product line and versions. Your records may hold a model number, a reseller’s name, or nothing at all.
  • No list of what is installed. Controllers, cameras, gateways and appliances installed by contractors are often missing from anyone’s inventory. CISA’s August 2025 guidance with partner agencies, Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators, starts there for that reason.
  • Nobody owns the feed. The subscription goes to one person’s inbox and stops when they leave.

Doing it yourself

  1. List what you runMaker, model and firmware or software version, by site.
  2. SubscribeTo the ICS advisories feed or email topic, and to KEV updates.
  3. FilterMatch each new advisory and KEV entry against your makers and products, loosely, then confirm the versions.
  4. Act and recordApply the mitigation or update, or record why not, with the date.

How our free sign-up works

  • You send a list. Makers and models, through the request form. Model names are enough; we do not need serial numbers, addresses or network details, and you should not send them.
  • We set you up within a week. After that you get CISA advisories and KEV entries matched to the equipment you list, with the link and the affected versions. Nothing else, and no sales calls.
  • Stop any time. Reply and we delete your list.

Independent. BSJ Ventures is not affiliated with CISA and does not speak for it. The advisories are CISA’s; we only filter them for you.

Questions people ask

How do I get CISA ICS advisories?
CISA publishes them at cisa.gov/news-events/ics-advisories, in RSS feeds for ICS advisories and ICS medical advisories, by email through its subscription page, and in machine-readable CSAF 2.0 format in the cisagov/CSAF repository on GitHub.
Can I get CISA advisories only for the equipment I own?
CISA's feeds and email topics carry all advisories, not just those for your equipment. You can filter them yourself against a list of your makers and models, or sign up with BSJ Ventures: we set you up within a week, and you get advisories matched to the equipment you list, free.
What is the difference between an ICS advisory and a KEV entry?
An ICS advisory describes newly disclosed vulnerabilities in industrial control and related equipment, with mitigations. A KEV entry means CISA has reliable evidence that a vulnerability is being actively exploited and that a clear fix exists. A flaw can appear in both.
Is BSJ Ventures part of CISA?
No. BSJ Ventures is an independent company in Red Bank, New Jersey. The advisories are CISA's public publications; the free sign-up only filters them against the makers and models you send.

Primary sources

General information, not legal advice. BSJ Ventures publishes methods; it never publishes clients, cases or verdicts, and it claims no relationship with any agency or maker named here.

← All guides and checks
Free

Sign up. We’ll set you up within a week.

Send the makers and models you run; you’ll get CISA advisories and Known Exploited Vulnerabilities entries matched to the equipment you list. No cost, no sales calls; stop any time.

Sign up for equipment advisories

A person reads every request. Model names only; do not send serial numbers, addresses or network details.