CISA's guide provides recommendations for patching, software risk assessments and responsible OSS project participation.