CISA Orders Federal Agencies to Prioritize Patching by Risk
Summary
CISA’s BOD 26-04 requires federal agencies to prioritize vulnerability remediation using risk-based timelines, monitor the KEV catalog, and inventory externally accessible assets. CISA also plans to provide standardized asset-tagging requirements.
Key points
- BOD 26-04 builds on the KEV catalog and BOD 22-01, requiring agencies to update vulnerability-management policies and remediate KEV-listed flaws.
- Agencies must monitor KEV updates, automate vulnerability-status reporting, and inventory and tag externally accessible assets.
- Some high-risk flaws affecting public-facing assets must be addressed within three days, including specified KEV-listed flaws that can be automated or provide total control.
- Lower-risk weaknesses have remediation timelines of 14 or 60 days, based on the directive’s criteria.
- CISA says it will publish standardized machine-level asset-tagging data requirements within 60 days.
- A BeyondTrust cybersecurity technologist argued that prioritization should also account for privilege pathways and privilege debt.
Article Details
- Event Type
- CISA issued Binding Operational Directive 26-04, requiring U.S. federal agencies to prioritize security updates based on risk.
- Impact
- Federal agencies must update vulnerability-management policies, prioritize KEV vulnerabilities, monitor catalog updates, remediate vulnerabilities within risk-based timelines, automate KEV status reporting, and inventory and tag externally accessible assets. Certain high-risk vulnerabilities affecting publicly exposed assets are due within three days; lower-risk vulnerabilities may have 14- or 60-day timelines. CISA also committed to updating the KEV catalog and publishing standardized asset-tagging data requirements within 60 days.