# Reduce doxing risk for leaders and staff with CISA’s 2026 measures for documents, data brokers and response > CISA’s February 2026 guidance defines doxing as gathering someone’s PII or an organization’s sensitive information and releasing it publicly or using it maliciously, notes it can lead to extortion, social engineering and swatting, and lists protective steps for documents, data brokers and social media, plus response steps for victims. - Canonical URL: https://update.dsesecurity.com/updates/cisa-2026-doxing-protective-measures-executives-staff-data-brokers-response/ - Publisher: Detection Systems & Engineering (DSE Security) - Author: DSE Security Editorial Team - Published: 2026-10-18T21:01:34+00:00 - Modified: 2026-10-18T22:22:09+00:00 - Last reviewed by DSE: 2026-10-18 - Resource type: Playbook - DSE priority: Advisory - Topics: Business Continuity, Cybersecurity - Reading time: 2 minutes ## What you need to know CISA’s February 2026 guidance defines doxing as gathering someone’s PII or an organization’s sensitive information and releasing it publicly or using it maliciously, notes it can lead to extortion, social engineering and swatting, and lists protective steps for documents, data brokers and social media, plus response steps for victims. ## Potentially affected Executives, security and IT staff, public-facing employees and their families, and the security teams responsible for protecting them, especially at organizations that attract grievances. ## DSE recommendation DSE recommends giving leaders and high-exposure staff a doxing prevention and response plan based on CISA’s guidance, including data-broker opt-outs and a single reporting path to the security office. ## Article CISA’s February 2026 guidance defines doxing as gathering someone’s PII or an organization’s sensitive information and releasing it publicly or using it maliciously, notes it can lead to extortion, social engineering and swatting, and lists protective steps for documents, data brokers and social media, plus response steps for victims. ## Source facts CISA’s [Protective Measures to Reduce Doxing on Critical Infrastructure Workers](https://www.cisa.gov/sites/default/files/2026-04/Protective-Measures-to-Reduce-Doxing_508%20Compliant.pdf), dated as of February 2026, defines doxing as gathering an individual’s PII or an organization’s sensitive information from open sources or compromised materials and releasing it publicly or using it maliciously. It says doxing can lead to extortion, social engineering attacks and swatting, and that organization leaders may be targeted because of their position or stance on an issue. CISA’s protective steps include secure storage and proper disposal of sensitive documents, regular audits of physical workspaces, opting out of data broker lists and requesting removal from public records websites, auditing personal and organizational social media accounts and their privacy and location tagging settings, and removing PII such as address, date of birth and phone number from profiles. It also advises being suspicious of unsolicited calls, visits or emails asking about employees, and enabling multifactor authentication for every account that offers it. If information is released, CISA says to determine what was exposed and how serious the threat is, report the incident to the organization’s security office, local law enforcement and the platforms involved, document it with screenshots, consider reporting to IC3 and CISA, work to remove the information, and watch for identity theft. If physical safety is a concern, it says to contact local law enforcement. ## Applicability Use this for any organization whose leaders or staff could be targeted. CISA notes that laws against doxing vary by jurisdiction, so check local law when planning removal and response steps. ## DSE recommendation DSE recommends giving leaders and high-exposure staff a doxing prevention and response plan based on CISA’s guidance, including data-broker opt-outs and a single reporting path to the security office. Limit employee details in newsletters, directories and conference materials, brief reception and security staff on calls asking about employees, and coordinate home alarm, camera and police contact steps for anyone targeted. ## Verification Review the plan yearly with the people it covers, spot-check data broker sites for their information, and run a tabletop exercise on a doxing incident that includes the security office and local law enforcement contacts. ## Official reference [CISA — Protective Measures to Reduce Doxing on Critical Infrastructure Workers (as of February 2026)](https://www.cisa.gov/sites/default/files/2026-04/Protective-Measures-to-Reduce-Doxing_508%20Compliant.pdf). Reviewed October 18, 2026. ## Primary reference - Name: CISA — Protective Measures to Reduce Doxing on Critical Infrastructure Workers (as of February 2026) - Authority: Cybersecurity and Infrastructure Security Agency - URL: https://www.cisa.gov/sites/default/files/2026-04/Protective-Measures-to-Reduce-Doxing_508%20Compliant.pdf - Source publication date: Not stated by the source ## Citation and use Preferred citation: “Reduce doxing risk for leaders and staff with CISA’s 2026 measures for documents, data brokers and response,” DSE Security, https://update.dsesecurity.com/updates/cisa-2026-doxing-protective-measures-executives-staff-data-brokers-response/ Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/ Usage and citation policy: https://update.dsesecurity.com/usage/ Copyright © 2026 Detection Systems & Engineering. All rights reserved.