Historical guidance
CISA Eviction Guidance · AR21-134A
Coordinated removal of an intruder across on-premises systems, identity and cloud trust.
On this page
Purpose, scope and authority
The report was tailored to federal Category 3 agencies: affected Orion use together with evidence of follow-on activity. CISA also encouraged other organisations to apply it where appropriate. This is a specific historical recovery procedure, not a generic instruction to disconnect every network. The full CISA text was consulted through the preserved AHA copy because direct retrieval from CISA was unavailable. [1]
Principles and operating logic [1]
1. Before eviction: establish the real boundary
Map systems that share logical trust or credentials with affected infrastructure. Investigate account activity, credentials used by management systems, federation and cloud permissions. Prepare visibility and hardening before the disruptive phase. A server list alone does not describe the reach of a compromised identity.
2. Use a protected coordination channel
The guide directs the affected agencies to use out-of-band communications for remediation plans and documentation. A plan stored or discussed on compromised systems may expose the operation to the intruder. Ensure the separate channel and its accounts can be trusted before relying on it.
3. Plan the operational interruption
The historical procedure anticipated substantial disruption, including a multi-day internet disconnection. Leadership needs to understand dependencies, resources and impact before approving execution. That estimate is specific to the report; it is not a universal recovery target or a promise that every environment can be remediated in the same period.
4. Eviction: coordinate the sequence
The report requires coordinated actions in the specified order, including rebuilding affected components and dealing with on-premises and cloud access. Credential and trust remediation must be planned together with clean administration. This editorial guide intentionally does not replace the detailed technical order or product-specific implementation checks.
5. After eviction: test the result
Validate the environment, monitor for continued activity and document incomplete actions and residual risk. Reconnection is a decision supported by evidence, not simply the end of a maintenance window. Review what remains unknown and what observations would trigger renewed containment.
Application · editorial recommendations
Our suggested readiness review asks whether scope is established, independent communications work, evidence has been preserved, recovery resources are available, critical functions can tolerate the interruption and the decision authority is present. Use the complete original procedure with qualified technical teams when assessing a comparable environment; validate current vendor guidance because identity platforms have changed since 2021.
Evidence for the CISO · proposed review pack
Retain a trust map, action sequence with owners and dependencies, evidence-preservation record, approved disruption plan, validation results and explicit residual-risk decision. Link incomplete tasks to follow-up dates. An attempted reset is not the same as evidence that every affected endpoint and identity relationship has been addressed.
Common mistakes and limits
Do not reset credentials through an untrusted administration path, restore systems without examining identity persistence, skip prerequisite steps to meet a calendar deadline or declare success solely because no fresh alert appeared. The transferable lesson is coordinated trust restoration; the historical technical procedure must be read in its original scope.
Official sources and reading route
Read these sections in the source: Summary; Pre-Eviction; Eviction; Post-Eviction.
Original study commentary, not a reproduction of the full publication. Read the linked source for every individual requirement, control enhancement, condition and exception. Applicability depends on the organisation and its governing obligations.