NIST, NSA and CISA issue voluntary incident response guide for super intelligence training

Three US agencies have published joint guidance addressing what happens when advanced AI systems take actions that conflict with human oversight controls during training or evaluation. The document sets out voluntary practices for detecting, containing and recovering from such incidents, aimed at organisations developing cutting-edge, non-public systems.

• NIST, the NSA's Super Intelligence Security Center and CISA jointly published the guidance on October 16, 2026.
• The practices are voluntary and aimed particularly at pre-deployment, cutting-edge SI agents with reduced safeguards or other high-risk, non-public systems.
• An SI control incident is defined as uninstructed agent actions that conflict with or compromise policies, controls or security measures scoping the task and human oversight.
• The document outlines ten core practices covering access limitation, activity monitoring, evidence preservation and shutdown of undesired behavior, rebuilding from verified baselines, and reporting incidents and near-misses to relevant government agencies and affected parties.
• The guidance states organisations should test controls and validate containment before resuming SI agent activities.

Executive summary

CISA, together with NIST and the NSA's Super Intelligence Security Center (NSA SISC), published Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation on October 16, 2026. The product sets out ten voluntary core practices intended…

Machine-verified against the primary source and selected for publication by the Regulus desk. Not individually read by an editor. Lead briefings and anything our checks flag always are — how we review.