Regulatory and advisory signals

What are regulators and advisory bodies publishing, and what should I act on?

845 advisories, recalls, notices and drafts were published in this period. Federal Register 56%, FDA recalls 29%, CISA 12%. 250 of them concern medical devices directly (CISA medical advisories and FDA recalls).

What this means for you

845 advisories, recalls, notices and drafts were published in this period.

Do this next

Triage every advisory against your asset inventory

This chapter's program actions come with a subscription

Start free and set your program

845

Advisories, recalls and notices

2022 to 2026

352

Vulnerability items

CISA advisories, FDA recalls

493

Guidance and regulation

Federal Register, NIST

250

Medical device specific

CISA medical and FDA

The flow

What regulators and advisory bodies are publishing

Items per month from the five sources the site tracks, split into vulnerabilities and guidance. Only the year range applies here; breach filters do not.

Vulnerability and guidance items per month845 vulnerability and guidance items were published in the selection; the largest stream is Federal Register (56%), and the most frequent tags are Health and Human Services Department, Notice, health IT.

How this is calculated

Counts every vulnerability and guidance item published in the selected years (CISA advisories, FDA device recalls with software or cybersecurity causes, Federal Register notices, NIST drafts and news); the breach filters do not apply to them. Tags come from each source; domains come from the site's CISSP/CISM/CISA keyword heuristic. The lagged correlation compares monthly vulnerability items with monthly Hacking/IT reports (breach filters applied) from lag −6 to +6 months, using only months since the vulnerability feed began. Both series have a straight-line trend removed before correlating, so two series that merely both grow over time do not look related; a positive lag means vulnerability volume moves first. It needs 24 months of overlap. Correlation, not causation: both series can move with a third factor (for example reporting practice or feed coverage), and the guide line is a Bonferroni-corrected 5% threshold across the 13 lags (z ÷ √n), which still overstates significance for autocorrelated monthly series.

Items by kindFederal Register is the largest stream (56%).

Click a bar to read those items in the Signals feed.

Table view


Federal Register	Federal Register	470
FDA recalls	FDA device recall	247
CISA	CISA advisory	102
NIST drafts	NIST draft for comment	14
NIST news	NIST news	9
CISA	CISA medical device advisory	3

Subscriber feature · $5 a month or $50 a year

Read the rest of Chapter 7: Regulatory and advisory signals

The findings, every chart with drill-down to the reports behind it, and what to do about it, recalculated for any state, entity type or year range you choose. Unlock all 14 chapters with a subscription.

Which domains the signals touch, and whether they move with breaches
What this means for your program: 2 key points
2 program actions mapped to HIPAA and NIST CSF 2.0, starting with “Triage every advisory against your asset inventory”
Exam angle for 6 CISSP, CISM and CISA domains, with a study prompt

Start free Or subscribe for $5 a month

Included with an ExamPrep subscription or as a DueCare site administrator. How linking works