BOD 26-04: CISA's Risk-Based Patch Mandate and What Organizations Must Do Now

CISA issued Binding Operational Directive 26-04, "Prioritizing Security Updates Based on Risk," on June 10, 2026. The directive is a compulsory order to all federal executive branch departments and agencies under 44 U.S.C. § 3553(b)(2). It revokes and supersedes both BOD 22-01 (issued November 2021) and BOD 19-02, while incorporating and expanding upon their core requirements. The practical result is that federal civilian agencies no longer use CVSS scores as the primary basis for vulnerability prioritization. The replacement is a four-variable model derived from the Stakeholder-Specific Vulnerability Categorization (SSVC) methodology.

For non-federal organizations, the directive is not binding, but it sets the standard that auditors, regulators, and supply chain partners will reference. Understanding the mechanics matters whether you're a federal agency or a private-sector entity that contracts with one.

Why CVSS-Based Prioritization Was Retired

BOD 19-02 established remediation timelines based on CVSS severity ratings for internet-accessible systems. A high score meant a short deadline. A lower score meant more time. The problem with this approach is well-documented: CVSS measures theoretical severity in a vacuum. It does not account for whether a vulnerability is being exploited in the wild, whether the affected asset is reachable from the internet, or whether exploitation can be automated at scale.

By revoking BOD 19-02, CISA formally ended the requirement for FCEB agencies to use CVSS as the prioritization mechanism. The replacement framework asks four operational questions about each vulnerability rather than relying on a single numerical score.

The SSVC-Based Four-Variable Model

BOD 26-04 evaluates every vulnerability against four decision points:

• Asset Exposure: Is the vulnerable system publicly accessible from the internet?
• Known Exploited Vulnerability Status: Is the vulnerability listed in CISA's Known Exploited Vulnerabilities (KEV) catalog?
• Automatability: Can exploitation be fully automated without manual intervention?
• Technical Impact: Does successful exploitation grant the attacker full control of the affected system?

A vulnerability that meets all four criteria falls into the most urgent remediation tier with a three-day deadline. Fewer criteria produce longer timelines depending on the specific combination of variables. This tiered approach allocates remediation effort based on actual operational risk rather than a static score.

CISA's Vulnrichment Program provides the data that feeds this model. The program enriches CVE records with SSVC decision points, CWE identifiers, and CVSS data, and bundles them directly into CVE records. That enrichment data is automatically included in existing CVE feeds through the Authorized Data Publisher (ADP) container. Organizations consuming standard CVE feeds already receive this data without additional integration work.

Remediation Timelines

The directive establishes remediation tiers based on the four-variable assessment. The highest tier is well-documented:

Note: The High and Standard tier criteria are determined by specific combinations of the four SSVC variables as detailed in the BOD 26-04 implementation guidance. Consult the implementation guidance for the full decision logic and to confirm exact remediation timelines.

The three-day window for the highest tier reflects the speed at which exploitation occurs once proof-of-concept code becomes available. The directive frames known exploited vulnerabilities as a significant attack vector, consistent with CISA's broader messaging about nation-state threats to U.S. critical infrastructure.

Forensic Triage Requirement

BOD 26-04 adds a requirement that goes beyond patching. When a vulnerability hits the highest remediation tier, agencies must perform forensic triage on affected systems to determine whether compromise has already occurred. The implementation guidance establishes specific forensic triage steps for prompt vulnerability response.

Applying a patch remediates the vulnerability but does not address pre-existing compromise. Forensic triage determines whether exploitation occurred before the patch was applied.

Specific Steps Organizations Must Take

The directive and its implementation guidance lay out concrete organizational requirements:

Immediately Upon Issuance

1. Update vulnerability management policies to incorporate processes for ongoing remediation of vulnerabilities listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
2. Adopt the SSVC-based prioritization model in place of CVSS-only prioritization. This means configuring vulnerability management tools to ingest and act on SSVC decision-point data from CVE feeds.
3. Establish forensic triage procedures for the highest-tier vulnerabilities. Define who performs triage, what artifacts are collected, and how results are reported.

Within 60 Days

1. Complete additional implementation milestones specified in the BOD 26-04 implementation guidance.
2. Review vendor and contractor agreements. Agencies must review contracts with vendors who support or operate agency information systems to confirm those contractors can support compliance with the directive's timelines. This extends the directive's reach into the contractor and managed-service-provider ecosystem.
3. Validate asset inventory accuracy. The four-variable model requires knowing which assets are internet-exposed. Organizations that lack accurate, current asset inventories cannot correctly apply the exposure variable.

FedRAMP Alignment

1. FedRAMP alignment. FedRAMP will require mandatory adoption of updated Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) rules on a timeline specified in the implementation guidance. Cloud service providers operating under FedRAMP authorization must comply with these updated rules. Refer to the FedRAMP Response to CISA BOD 26-04 for current deadlines and details.

How This Affects Organizations Outside Federal Government

BOD 26-04 applies directly to Federal Civilian Executive Branch (FCEB) agencies. Private-sector organizations, state and local governments, and critical infrastructure operators are not bound by it. That said, the directive will likely produce second-order effects across several categories of organizations:

Federal contractors and managed service providers. The directive's requirement that agencies review vendor contracts for compliance support means contractors operating federal systems will need to demonstrate they can meet the directive's remediation timelines. Expect contract modifications and new SLA requirements.

FedRAMP-authorized cloud service providers. The FedRAMP VDR and VER rule adoption timeline makes this mandatory for any CSP holding or seeking FedRAMP authorization.

Organizations in critical infrastructure sectors. CISA's framing of known exploited vulnerabilities as a threat to critical infrastructure signals that future guidance for critical infrastructure sectors will likely mirror the SSVC-based approach.

Cyber insurance underwriters. Insurers already reference CISA directives and KEV catalog compliance in policy assessments. We assess that BOD 26-04's framework will likely become a benchmark for evaluating patch management maturity.

Practical Implementation Considerations

The shift from CVSS to SSVC changes the data pipeline for vulnerability management programs. Several operational adjustments are necessary:

Ingest Vulnrichment data. CISA's SSVC enrichment data flows through the ADP container in standard CVE feeds. Verify that your vulnerability management platform parses and displays ADP container data. Some platforms may require configuration changes or updates to surface SSVC decision points alongside traditional CVSS scores. CISA's Vulnrichment data is available on GitHub at https://github.com/cisagov/vulnrichment.

Map asset exposure accurately. The "asset exposure" variable requires knowing which systems are reachable from the internet. This demands current, validated external attack surface data. Organizations using external attack surface management (EASM) tools should cross-reference those findings with internal asset inventories.

Automate tier classification. Manually evaluating four variables for every vulnerability is not scalable. Build or configure automation rules that consume SSVC data points and asset context to assign vulnerabilities to the correct remediation tier.

Establish forensic triage playbooks. The three-day tier requires forensic triage in parallel with patching. Define the scope of triage: log review periods, indicator sweeps, memory analysis thresholds, and escalation criteria for confirmed compromise.

Analysis

BOD 26-04 reflects a deliberate shift in how the federal government thinks about vulnerability risk. The move from CVSS to SSVC acknowledges that a vulnerability's score tells you very little about whether it will actually be used against your organization. The four-variable model forces a more operationally relevant assessment.

The three-day remediation timeline for the highest tier is aggressive but not arbitrary. It targets a specific category: internet-facing, KEV-listed, automatable, full-impact vulnerabilities. That combination describes the exact scenario where delay results in compromise.

The forensic triage requirement is a meaningful addition. Most vulnerability management programs treat patching as the end state. BOD 26-04 treats it as a necessary but insufficient step, acknowledging that exploitation often precedes patch deployment.

The contractor review requirement is worth close attention. Federal agencies rely heavily on managed service providers, cloud service providers, and system integrators. Pushing compliance obligations into vendor contracts creates accountability across the entire operational chain.