NIST, CISA, and the NSA's Super Intelligence Security Center published a joint product on October 16, 2026 giving ten voluntary practices for organizations that train and evaluate highly capable agents on long-horizon tasks with limited supervision. The practices are organized as prepare, detect, respond, recover, and report. The product defines a control incident as an agent taking uninstructed actions that conflict with the policies and oversight controls meant to scope its task, even when the impact stays internal.
The practices cover limiting agent access to information, systems, tools, and networks, monitoring for unexpected activity, preserving evidence, validating containment before resuming activity, rebuilding from verified baselines, and reporting incidents and near misses to government agencies and affected parties. It is the first United States government playbook aimed specifically at agent control failures.