CISA has issued Binding Operational Directive 26-04 to force federal agencies to prioritize patching the most dangerous vulnerabilities, especially those in the Known Exploited Vulnerabilities catalog and on publicly accessible assets. The directive introduces tighter remediation timelines, expanded policy requirements, and a stronger focus on risk-based vulnerability management across federal networks. #CISA #BOD2604 #KEV
Keypoints
- CISA issued Binding Operational Directive 26-04 for federal agencies.
- The directive builds on the Known Exploited Vulnerabilities catalog and BOD 22-01.
- Agencies must update vulnerability policies and provide them to CISA on request.
- Publicly exposed KEV flaws that can be automated must be fixed within three days.
- CISA will publish data requirements and support automated KEV reporting and asset tagging.