# NIST NSA CISA Issue Voluntary AI Incident Practices

On October 16, 2026, NIST, NSA, and CISA issued voluntary incident-readiness practices for organizations that train or evaluate advanced AI agents. The practices cover five stages—Prepare, Detect, Respond, Recover, and Report—and are not binding compliance guidance. They may nevertheless inform future federal contract requirements and assessments of reasonable AI safeguards, making agent incident readiness relevant to contractors and agencies evaluating AI-related work.

- Contractors working with advanced AI agents can review their controls, evidence-retention practices, incident reporting, and third-party contract terms against the five-stage framework.
- Because the practices are voluntary, they do not create a mandatory compliance obligation; however, they may shape expectations in future federal procurement and safeguard assessments.
- Procurement teams can use the framework as a reference when evaluating AI-agent risk controls and contract provisions.

**Jurisdictions:** federal
**Industries:** Information Technology
**Topics:** Artificial Intelligence, Cybersecurity
**Published:** November 03, 2026

### Government Entities
- National Institute of Standards and Technology (NIST)
- National Security Agency (NSA)
- Cybersecurity and Infrastructure Security Agency (CISA)
- NIST Center for Advancing Innovation and Standards for Super Intelligence (CAISSI)
- NSA Super Intelligence Security Center (SISC)

### Sources
- [When the AI Agent Goes Off-Script: The First Incident Playbook for Frontier AI | Epstein Becker Green](https://www.ebglaw.com/workforce-bulletin/when-the-ai-agent-goes-off-script-the-first-incident-playbook-for-frontier-ai) - Epstein Becker Green