CISA BOD 26-04: Risk-Based Vulnerability Remediation

CISA Binding Operational Directive 26-04 establishes risk-based remediation requirements for covered federal civilian agencies. It uses four decision signals: asset exposure, Known Exploited Vulnerabilities (KEV) status, exploit automation, and technical impact. The directive's Table 1 supplies the timelines; its day counts have not been independently verified here and are intentionally omitted.

What the directive says

The four decision signals provide context for prioritizing remediation. KEV status is one signal among the four; the directive should not be summarized as assigning it an unverified priority over the others. Consult the directive and agency guidance for the applicable Table 1 timeline and implementation details.

The directive was issued June 10, 2026. Its transition period is expressed as within 60 days of issuance (by early August 2026). This article does not infer additional deadlines or describe a product capability as satisfying the directive.

Practical vulnerability-management workflow

Maintain an inventory that records exposure and business context, track KEV status, evaluate whether exploitation is automated, and document technical impact. Keep the source and date for each input so analysts can review changes. Route findings through an owned remediation process, record decisions and evidence, and verify fixes.

These operational practices help teams organize work. They do not establish that an agency or provider meets BOD 26-04, and they do not substitute for the directive, agency instructions, or verified Table 1 timelines.

Relationship to FedRAMP

BOD 26-04 is an agency directive and its Table 1 values are not reproduced here. FedRAMP's 2026 Consolidated Rules separately use VDR/VER requirements for cloud service providers. The directive and the FedRAMP rules have distinct scopes; do not use one as a substitute for the other.

How Advisedly helps

TRACE Score uses risk signals to help prioritize findings. That score is an aid for review and does not determine BOD 26-04 compliance or provide the directive's remediation deadlines.