CISA Orders Federal Agencies to Patch Certain Vulnerabilities Within 72 Hours
Summary
CISA’s directive requires federal civilian agencies to patch vulnerabilities meeting three of four risk criteria within 72 hours. Agencies have 180 days to adopt the timeline and must assess possible compromise before patching in certain cases.
Key points
- The four criteria are public-internet exposure, inclusion in the KEV catalog, automation potential, and the level of system control attackers could gain.
- Vulnerabilities meeting three criteria generally require patching within 72 hours; non-automatable cases may have up to two weeks if an attacker has not taken full control.
- When a vulnerability could give attackers complete control, agencies must check whether systems were compromised and patch within three days.
- The directive gives agencies 180 days to adopt the new timelines and requires them to check when and how a system was compromised before patching.
- CISA says patching alone may not remove an attacker and offers assistance with forensic triage.
- CISA urges state, local, tribal, and critical infrastructure organizations to adopt similar practices.
Article Details
- Event Type
- CISA issued a binding operational directive requiring federal civilian agencies to prioritize and patch certain high-risk vulnerabilities.
- Impact
- Vulnerabilities meeting at least three of four criteria—public internet exposure, listing in the KEV catalog, automation potential, and the level of attacker control—must generally be patched within 72 hours. Agencies have 180 days to adopt the timeline and must assess whether affected systems were compromised before patching. Some qualifying vulnerabilities that are not automatable may have a two-week patch deadline if an attacker has not taken full control. CISA urged state, local, and tribal governments and critical infrastructure organizations to adopt similar practices.
People
Chris ButeraCISA Acting Executive Assistant Director for Cybersecurity; explained the directive’s criteria and timelines and discussed the role of AI in accelerating vulnerability exploitation.Mark WarnerIntroduced legislation directing CISA to collaborate with industry and regulators to modernize cybersecurity defense.Nick AndersenActing CISA Director; issued a statement describing the directive’s prioritization and vulnerability remediation goals.