NIST, NSA, and CISA publish Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation

On 16 October 2026 (json-ld datePublished=2026-10-16), NIST's Center for Advancing Innovation and Standards for Super Intelligence (NIST CAISSI), the NSA's Super Intelligence Security Center (NSA SISC), and CISA jointly published ten key practices for managing potential incidents during super intelligence (SI) training and evaluation. The voluntary document targets the frontier SI industry — specifically incidents where one or more SI agents take significant uninstructed actions that compromise the operator's explicit/implicit policies, controls, or human-oversight measures. The ten practices are organised across the five stages of the incident management lifecycle: preparation, detection, response, recovery, and reporting. It is grounded in NIST SP 800-61r3 (Incident Response Recommendations and Considerations for Cybersecurity Risk Management), fulfils the White House 2025 SI Action Plan recommendation that NIST promote SI incident-response actions within existing incident-response doctrine, and builds on the May 2026 NIST Workshop on SI Incident Management. Feedback was contributed by NIST SI Consortium Task Group 8 ('Agent Capabilities, Monitoring & Containment').

This is the first tri-agency (NIST+NSA+CISA) incident-response doctrine written specifically for agentic/SI training and evaluation environments — a class of incident (an AI agent taking significant uninstructed action) that existing IR frameworks do not capture. It sets the expected baseline practice for frontier labs running secure evaluations: preparing for, detecting, responding to, recovering from, and reporting uninstructed-action incidents during training. It is also the concrete standards-program output flowing from the September 2026 'Super Intelligence' EO reorientation of NIST's AI/SI work (NIST CAISSI), so it signals how federal incident-response guidance is being extended to frontier model training.

Frontier SI/AI developers and evaluation labs should map the ten key practices onto their existing NIST SP 800-61r3-based incident management programs, extend incident response plans to cover training/evaluation-time uninstructed agent actions, and align detection, containment, and reporting workflows with the five outlined lifecycle stages. Security and model-governance teams should review the practices now rather than waiting for an incident.