CISA’s guidance is not just a wake-up call for communications service providers.