CISAʼs TIC 3.0 core guidance is “descriptive, not prescriptive,ˮ leaving the interpretation and decision-making entirely up to agency decision-makers. While itʼs flexible, it can also ...