CISA Sets Federal Vulnerability Patching Deadlines as Short as Three Days
Summary
CISA’s BOD 26-04 directs FCEB agencies to prioritize vulnerability remediation using exposure, KEV status, exploit automation, and impact. Deadlines can be as short as three days; agencies have 180 days to follow the new timelines.
Key points
- BOD 26-04 applies to U.S. Federal Civilian Executive Branch agencies and the information systems they operate.
- Prioritization considers public exposure, inclusion in CISA’s Known Exploited Vulnerabilities catalog, exploit automation, and the level of system control an exploit provides.
- Some high-risk vulnerabilities must be remediated within three days; less urgent cases may have a two-week deadline.
- Agencies are directed to update vulnerability-management policies and asset inventories and automate KEV status reporting.
- Agencies have 60 days to update vulnerability-management processes and 180 days to comply with the new timelines and continuously monitor and report asset metadata.
- The article says the directive supersedes BOD 19-02 and BOD 22-01; it also contains an inconsistent reference to BOD 20-04.
Article Details
- Event Type
- CISA issued Binding Operational Directive 26-04, a vulnerability-remediation directive for Federal Civilian Executive Branch agencies.
- Impact
- The directive sets accelerated remediation deadlines for high-risk vulnerabilities, with some requiring fixes within three days. It also requires agencies to update vulnerability-management policies and asset inventories, automate Known Exploited Vulnerabilities reporting, and adopt the new remediation timelines and continuous asset monitoring.