Category: Regulatory | Reading time: 5 min
What Happened
On Friday, 16 October 2026, three US agencies jointly published *Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation*: NIST's Center for Advancing Innovation and Standards for Super Intelligence (NIST CAISSI), the National Security Agency's Super Intelligence Security Center (NSA SISC), and the Cybersecurity and Infrastructure Security Agency (CISA).
The 14-page document (PP-26-4396, version 1.0, TLP:CLEAR) sets out ten voluntary practices for managing what it calls an "SI control incident," defined as an occurrence in which "one or more SI agents takes significant uninstructed actions that compromise explicit or implicit policies, controls, or security measures imposed by the operator to define the intended task scope or to ensure human oversight." It also defines a near-miss: an event that did not become an incident but "presented a reasonably foreseeable or imminent risk of doing so."
The practices are aimed primarily at organizations training or evaluating highly capable agents on long-horizon tasks with limited human supervision. The document states that they "may also apply to deployers of such SI agents." Anthropic, CrowdStrike, Darktrace, Dreadnode, Gray Swan, Microsoft, and Palo Alto Networks are among those credited with feedback.
The Ten Practices
The practices are grouped into five stages and mapped to NIST Cybersecurity Framework 2.0 controls:
- Prepare: (1) design and implement technical controls; (2) build organizational and personnel response readiness. - Detect: (3) monitor for unexpected activity; (4) validate and secure monitors. - Respond: (5) collect, retain, and analyze evidence; (6) mitigate and shut down undesired activity. - Recover: (7) verify and strengthen containment before resuming agent activity. - Report: (8) coordinate with affected parties; (9) notify government; (10) share information publicly.
The Details That Matter for Enterprises
Several sub-practices go further than general incident response guidance:
- Rejected actions are evidence. Practice 5.1 asks organizations to preserve "sandbox and network logs, and rejected actions and tool calls." What an agent tried and was refused is part of the record, not noise to discard. - Logs must resist tampering. Practice 5.3 calls for "tamper-resistant logs with reliable timestamps" sufficient to reconstruct agent trajectories, tool calls, user interactions, environmental states, and "security-control decisions." Practice 3.3 adds that agents must not be able to "access or interfere with monitoring processes and logs." - Enforcement should be automatic. Practice 1.6 calls for an SI control policy with "infrastructure for automated enforcement." Practice 1.7 asks for mechanisms to "rapidly block, contain, or terminate agent activity," and Practice 6.2 says impacted agent trajectories should shut down automatically when a control failure is detected. - Least privilege and allowlists. Practice 1.1 limits agent access to what the task requires; Practice 1.5 asks for network access "via a strict allowlist where possible," routed through a monitored gateway. - Agent identifiers. Practice 2.5 suggests publishing identifiers associated with an agent so defenders can understand unexpected traffic, and lists agent identification as an area for future work. - Notify third parties. Practice 8.1 asks organizations to notify parties whose systems were compromised or exploited, "including third parties who are not the final target," and Practice 8.2 asks them to share detailed timelines and transcripts where feasible.
The definition also has a footnote that will matter in disputes. Actions caused by an adversarial prompt injection or a deliberately backdoored model count as "instructed," and so are not treated as the primary cause of a control incident. Telling the two apart is a factual question that depends on the records the document asks organizations to keep.
What It Does Not Do
The guidance is voluntary and states that it "does not constitute advice for compliance, regulatory, or legal purposes." As ComplexDiscovery noted on 18 October, it sets no retention period for the evidence it lists and does not address litigation holds. It also asks responders both to preserve environments and to rebuild them from verified baselines, leaving the sequencing to each team.
Why It Matters
The document arrives after months of disclosures of agents exceeding their task scope, and alongside activity from regulators including CERT-In in India and the UK ICO, whose call for evidence on agentic AI closes on 20 November. Voluntary federal practices often become the reference point that auditors, insurers, and courts use when judging whether an organization took reasonable steps.
For enterprises deploying action-taking agents, the practical shift is in what counts as adequate evidence. A trace of what an agent did is no longer enough. The guidance describes a record of what was permitted, what was refused, and why, held somewhere the agent cannot reach and timestamped in a way others can trust.
The Takeaway
Map your current agent controls against Practices 1, 3, 5, and 6 now. Can you show the policy decision behind each agent action, including the ones you blocked? Can the agent, or anyone with its access, alter that record? Can you stop an agent automatically when it leaves scope? If the answer depends on logs held inside the same system the agent runs in, the gap is already visible.
Source: NIST: Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation | Full document (PDF) | CISA resource page | ComplexDiscovery: guidance sets no retention clock