Why CISA’s Ivanti disconnect order was decided by people, before it was issued
CISA gave federal agencies about two days to unplug and rebuild their Ivanti gateways. The steps were documented. What decided who met the deadline was who could authorize cutting remote access, who could rebuild the devices, and where agencies sat in their contractors’ queues.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
In early January 2024, Ivanti disclosed two vulnerabilities in its Connect Secure and Policy Secure gateways that attackers were chaining for unauthenticated remote code execution. On January 19, CISA issued Emergency Directive 24-01, requiring federal civilian agencies to apply Ivanti’s mitigation and run its integrity checking tool. On January 31, after more vulnerabilities were disclosed and attackers were seen working around the mitigation, CISA issued supplemental direction. Agencies had to disconnect all affected products from their networks by 11:59 p.m. on February 2. Before reconnecting, they had to rebuild or factory reset the devices, apply patches, and revoke and reissue certificates, keys and passwords stored on them. They were also told to assume that associated domain accounts were compromised, with credential resets due by March 1. The directive bound federal civilian agencies. CISA urged other organizations, including state and local governments, to take similar steps.
Earlier articles in this series have treated emergency patching as a problem of inventory and threat hunting. The January 31 direction exposed a different constraint. Most affected agencies knew they had Ivanti gateways; the devices were the front door for remote staff. The hard part was human. Meeting the deadline required three things of people, in sequence. Someone needed the authority to take remote access away from a workforce. Someone needed the skills to rebuild the device and reset what it touched. And a contractor had to put the agency first when every customer faced the same deadline. Each constraint was set months earlier, by decisions about delegations, staffing and contracts.
Who decides: the authority to cut remote access
Disconnecting a VPN gateway means some staff cannot work until it returns. For an agency with field inspectors, benefits processors working from home, or contractors who connect only through that gateway, that is a mission decision. A security officer can recommend it. In most agencies, only a program executive or the deputy secretary’s office can accept the impact.
Where that decision had not been delegated in advance, the clock started late. The directive arrived, the security team briefed the CIO, the CIO briefed leadership, and leadership asked which operations would stop. Each step took hours that the deadline did not include.
The agencies that moved quickly had settled two things beforehand. They had a written delegation that let the CIO or CISO disconnect an internet-facing device under a federal directive without further approval. They also had a documented degraded mode for remote work: a second access path for priority users, a list of staff who would come on site, and a message ready for the workforce. With those in place, the disconnect was a planned outage rather than an executive debate.
State and local governments faced a version of the same problem without the directive’s force. CISA could only urge them to act. A county IT director who wanted to take the remote-access gateway offline over a weekend had to persuade department heads, a sheriff’s office or a court administrator, none of whom reported to IT. Where an incident response plan already named the IT director as the decision-maker for emergency disconnects, the conversation was short. Where it did not, the gateway often stayed up while the device was patched in place, which was exactly the approach the supplemental direction had judged insufficient for federal networks.
Who does: skills to rebuild and reset
A factory reset or rebuild of a gateway is routine for an experienced network engineer. The full sequence is longer. It needs a known-good configuration to restore, new certificates issued and installed, integration with the identity provider reconnected, and testing before users return. The supplemental direction also told agencies to assume that domain accounts associated with the devices were compromised. On-premises passwords were to be reset twice, Kerberos tickets revoked, and then cloud tokens revoked in hybrid environments. That reached deep into Active Directory and cloud identity.
Those steps span three skill sets: network engineering, public key infrastructure and identity administration. In a large department these sit in separate teams that rarely work the same weekend. In a small agency they may rest with one or two people. A common failure point is more mundane: nobody can reach the one person who holds the device’s administrator credentials or the certificate authority access.
The workforce controls are simple and often missing. Each critical edge device should have at least two named people, staff or contractor, who have rebuilt it in an exercise within the past year. The configuration backup and rebuild procedure should be stored outside the device and outside the network it protects. Identity teams should have a rehearsed runbook for revoking and reissuing credentials tied to a compromised appliance, including service accounts.
Who else is waiting: the contractor queue
Many agencies do not operate their own edge devices. A managed service provider or a systems integrator runs them under a task order. On January 31, those providers faced the same deadline across every federal customer at once, plus commercial customers acting on CISA’s recommendation. Their engineers became the scarcest resource in the response.
Contracts rarely addressed this. Typical service levels covered incident response times for outages, not surge capacity for a directive that hits every customer simultaneously. An agency had little contractual basis to insist on going first. Agencies with small task orders were likely to wait longest.
There are practical fixes. Contracts for managed network and security services can name federal emergency directives as a priority event, with a defined response time and a requirement for the provider to report its plan within hours. Agencies can require that the provider’s staffing plan cover simultaneous demand. At a minimum, the agency should hold its own administrator access and configuration backups, so its staff can act if the provider cannot.
These three constraints are independent. An agency can have clear authority and skilled staff yet still wait on a contractor, or a responsive contractor and no one empowered to approve the outage. Each must be resolved before the next directive, because none can be fixed in 48 hours.
With hindsight
The Ivanti episode continued. On February 29, 2024, CISA and partner agencies warned that Ivanti’s integrity checker could miss compromise and that an attacker might keep persistence through a factory reset. In March, CISA said two of its own systems had been compromised through Ivanti vulnerabilities. In April, MITRE disclosed that a research network had been breached through the same flaws in January. Ivanti Connect Secure faced another exploited zero-day in January 2025, and CISA issued further emergency directives in 2025, including one on Cisco firewalls that September. The pattern held: each order came with a deadline in days and assumed that agencies had the authority, people and contract terms to act. An agency that wrote down its delegations and named rebuild owners after the Ivanti weekend had, in effect, rehearsed for every directive that followed.