Earlier this month CISA issued a binding operational directive ordering civilian agencies to remove any “networked management devices" from the open internet within two weeks.