CISA BOD 26-04: Risk-Based Patching Replaces the Sprint Mentality

In February 2024, a mid-size defense subcontractor pushed an emergency FortiOS patch (CVE-2024-21762) to their perimeter firewalls within seven days of CISA adding it to the KEV catalog. They should have been proud of that response time. Instead, they were still compromised --- because the patch sprint consumed their entire vulnerability management team for a week, leaving 340 internal findings untouched, including a Citrix Bleed (CVE-2023-4966) exposure on an internal NetScaler appliance that a threat actor had been exploiting for session hijack since November. They patched the front door while leaving the back window open.

That is the failure mode BOD 26-04 was designed to correct. On June 10, 2026, CISA formally retired the blanket-timeline approach to patching and replaced it with something that should have existed from the start: risk-based prioritization that accounts for an organization's actual exposure, not just a vulnerability's theoretical severity.

Why Now: The End of One-Size-Fits-All Deadlines

BOD 22-01 served its purpose. When CISA launched the KEV catalog in November 2021, the directive's 14-day remediation window forced federal agencies to take vulnerability management seriously for the first time. Before BOD 22-01, many agencies had no formal process for prioritizing patches. The blanket deadline created urgency where none existed.

But by 2025, the limitations were obvious:

Flat deadlines create perverse incentives. When everything gets the same 14-day window, security teams optimize for compliance documentation rather than risk reduction. A remotely-exploitable RCE on a public-facing system gets the same deadline as a local-privilege-escalation bug on an air-gapped workstation. The team treats both identically because the metric does not distinguish between them.

Sprint culture causes burnout and drops. Organizations that built their vulnerability programs around "patch everything in 14 days" discovered an uncomfortable truth: the volume of KEV additions accelerated faster than their remediation capacity. In 2023, CISA added 187 new KEV entries. The 14-day clock restarted with each one. Teams oscillated between crisis mode and everything-else mode, with "everything else" perpetually deferred.

Context-free urgency is not security. A vulnerability's risk is not a property of the CVE alone. It depends on where the vulnerable asset sits in the network, what it can reach, whether compensating controls exist, whether the specific exploitation technique applies to the organization's configuration, and whether threat actors are targeting the organization's sector. BOD 22-01 could not encode any of that.

BOD 26-04 acknowledges what practitioners already knew: security is resource allocation under uncertainty, and resources allocated without context are resources misallocated.

What BOD 26-04 Actually Requires

The directive introduces a three-tier prioritization model that replaces the flat 14-day mandate with risk-adjusted timelines:

Tier 1: Immediate Action (72 hours)

Reserved for vulnerabilities meeting ALL of the following criteria:

Listed in the CISA KEV catalog
Remotely exploitable without authentication
Present on internet-facing or boundary-adjacent assets
Active exploitation observed targeting the organization's sector

This tier is narrower than most people expect. Of the more than 1,300 entries in KEV, fewer than 15% would qualify for Tier 1 treatment in any given organization at any given time. The directive explicitly acknowledges that context determines tier, not just the CVE.

Tier 2: Priority Remediation (14 days)

The bulk of KEV entries fall here for most organizations:

KEV-listed vulnerabilities not meeting all Tier 1 criteria
Critical-severity findings on internal systems with CUI or PII exposure
Vulnerabilities with active exploit code and high EPSS scores (>0.7) targeting the organization's technology stack

Tier 3: Managed Risk (30 days with documented compensating controls)

The directive acknowledges what was previously unspoken: some findings cannot be patched within two weeks without causing more damage than the vulnerability itself. Tier 3 allows extended timelines when:

The vulnerable system cannot accept downtime without mission impact
A compensating control demonstrably reduces exploitability (network segmentation, WAF rule, disabled service)
The organization documents the risk acceptance with a named authorizing official
A defined remediation plan exists with a specific completion date

This is not a free pass. The documentation requirements are stringent, and inspector general audits will evaluate whether Tier 3 classifications are justified or whether organizations are gaming the system.

The Contrarian Take: Most Organizations Are Not Ready for Risk-Based Anything

Here is the uncomfortable truth that CISA's directive exposes: risk-based prioritization requires knowing your risk. Most organizations cannot answer basic questions that the three-tier model demands:

Which assets are internet-facing? (Asset inventory gaps)
Which assets contain CUI? (Data classification gaps)
What compensating controls exist for a given vulnerability? (Architecture documentation gaps)
Is our sector being actively targeted with this specific exploit? (Threat intelligence gaps)

BOD 26-04 assumes organizations have a risk scoring capability that synthesizes these inputs into actionable tier assignments. For organizations still running vulnerability management out of spreadsheets --- and many federal agencies still are --- the directive's flexibility is actually harder to operationalize than the old flat deadline. At least "patch everything in 14 days" required no analytical capability.

The directive does not say this explicitly, but the implication is clear: you need a risk score that accounts for asset context, threat intelligence, exploitability evidence, and compensating controls. A CVSS score alone does not get you to tier assignment. Neither does KEV status alone.

How Risk Scoring Makes BOD 26-04 Achievable

The tier model maps directly to what a composite risk score should produce. Consider the inputs:

BOD 26-04 Criterion	Risk Score Input
Internet-facing asset	Asset exposure context
Active sector targeting	Threat intelligence correlation
Remotely exploitable	Exploitability analysis (EPSS, exploit maturity)
CUI/PII presence	Data classification overlay
Compensating controls	Architecture and control mapping
KEV status	Confirmed exploitation flag

A well-constructed risk score --- one that consumes asset inventory, data classification, network topology, threat feeds, and exploit intelligence --- produces tier assignments automatically. The score does not just rank vulnerabilities. It answers the question BOD 26-04 asks: "What does this vulnerability mean for THIS organization, right now?"

This is exactly what the TRACE Score was designed to compute. By correlating vulnerability data with asset context, threat intelligence feeds, control mappings, and exploitation evidence, the scoring engine produces a prioritized queue that maps directly to BOD 26-04's three-tier model without requiring analysts to manually classify each finding.

Operationalizing the Three Tiers

Building the Tier 1 Detection Pipeline

Tier 1's 72-hour window means your detection-to-action pipeline must be measured in hours, not days. The workflow:

Continuous KEV monitoring --- ingest the KEV JSON feed on a sub-hourly cadence
Asset correlation --- immediately correlate new KEV entries against your asset inventory to identify affected systems
Exposure classification --- automatically flag internet-facing instances using network topology data
Sector targeting check --- cross-reference against threat intel for active campaigns targeting your vertical
Auto-ticket generation --- create a remediation ticket with Tier 1 SLA before a human even reads the advisory

Organizations that process KEV additions manually --- waiting for the weekly vulnerability review meeting --- will never meet Tier 1 timelines consistently.

Managing Tier 2 at Scale

Tier 2's 14-day window is familiar, but the scoping criteria are different. Under BOD 22-01, every newly added KEV entry got the same two-week window regardless of context. Under BOD 26-04, Tier 2 is the middle bucket: important, but not the "drop everything" tier.

The operational challenge is volume management. A typical federal agency with 10,000 assets might have 200-400 open KEV-applicable findings at any given time. With proper risk scoring, perhaps 20-30 qualify as Tier 1. The remaining 170-370 are Tier 2 candidates that need systematic remediation within 14 days.

This is where patch management automation earns its keep. Manual patching workflows cannot sustain Tier 2 volumes alongside Tier 1 emergencies without dropping balls. Automated deployment pipelines, pre-tested patch packages, and staged rollout procedures become compliance necessities, not operational luxuries.

Documenting Tier 3 Defensibly

Tier 3 is where organizations will be audited most aggressively. CISA and IG offices will scrutinize whether Tier 3 classifications represent genuine compensating-control situations or whether they are being used as an escape hatch for under-resourced teams.

A defensible Tier 3 classification requires:

Named authorizing official who accepts the extended timeline
Documented compensating control with evidence it reduces exploitability
Defined remediation date (not "TBD" or "next maintenance window")
Continuous monitoring evidence that the compensating control remains effective
POA&M entry with milestone tracking

The documentation burden is intentionally high. CISA wants organizations to feel the friction of Tier 3 classification so they do not default to it.

What Changes for Federal Contractors

BOD 26-04 directly binds Federal Civilian Executive Branch agencies. But DIB contractors should not wait for the contract language to catch up:

DFARS 252.204-7012 already requires "adequate security" for CUI systems. Risk-based vulnerability management --- as defined by the binding federal standard --- will become the floor expectation during CMMC assessments.

C3PAO assessors will reference BOD 26-04's tier model when evaluating vulnerability management maturity. An organization still running flat 14-day SLAs across all findings signals immaturity relative to the federal standard.

Supply chain flow-down is inevitable. Prime contractors managing their subcontractor risk posture will adopt the three-tier model because it provides a more granular view of actual security than "number of open findings."

SPRS scores will eventually reflect whether vulnerability management programs demonstrate risk-based prioritization. Organizations still self-reporting scores based on blanket-deadline compliance will face scrutiny when auditors compare their program against the BOD 26-04 standard.

Key Takeaways

BOD 26-04 replaces blanket 14-day remediation windows with a three-tier risk-based model: 72 hours, 14 days, and 30 days with documented compensating controls.
Tier assignment depends on organizational context (asset exposure, data sensitivity, sector targeting), not just vulnerability severity.
Most organizations lack the analytical infrastructure --- asset inventory, data classification, threat intelligence correlation --- to implement risk-based tiering without tooling.
A composite risk score that synthesizes context, threat data, and exploitability is the operational prerequisite for BOD 26-04 compliance.
Federal contractors should adopt the three-tier model now, before contract language mandates it through DFARS and CMMC updates.
Tier 3 documentation requirements are intentionally burdensome --- organizations that over-use extended timelines will face IG scrutiny.

Frequently Asked Questions

Does BOD 26-04 apply to DoD contractors?

BOD 26-04 directly binds Federal Civilian Executive Branch agencies. DoD and the Intelligence Community operate under separate directives. However, the three-tier risk-based model will influence CMMC assessments, DFARS adequate-security expectations, and supply chain requirements. DIB organizations should treat it as the emerging standard regardless of direct applicability.

Can we still use the 14-day remediation window for all KEV entries?

Technically, patching everything within 14 days exceeds BOD 26-04's minimum requirements for Tier 2 and Tier 3 findings. The risk is that flat-timeline approaches fail to prioritize Tier 1 findings for the 72-hour window. If your team treats everything as "14 days" and a Tier 1 finding slips past the 72-hour mark, you are non-compliant. The directive rewards nuance, not speed alone.

What qualifies as a "compensating control" for Tier 3?

CISA has not published an exhaustive list, but examples include: network segmentation that prevents exploitation from untrusted networks, WAF rules that block the specific exploitation technique, disabling the vulnerable service or component, or restricting access to authenticated internal users when the exploit requires unauthenticated access. The control must demonstrably reduce exploitability of the specific vulnerability --- generic security controls (e.g., "we have a firewall") do not qualify.

How does EPSS relate to BOD 26-04 tier assignment?

EPSS (Exploit Prediction Scoring System) is one input to tier determination but not the sole determinant. A high EPSS score (>0.7) on a vulnerability affecting your technology stack is a Tier 2 indicator. EPSS combined with KEV listing, internet-facing exposure, and sector targeting elevates to Tier 1. EPSS alone --- without confirmed exploitation --- does not trigger BOD 26-04 obligations, which are anchored in the KEV catalog.

Does BOD 26-04 replace BOD 22-01?

Yes. BOD 26-04 supersedes BOD 22-01's remediation timeline requirements while retaining the KEV catalog as the primary input. The catalog itself remains unchanged. What changed is how organizations must respond to catalog entries --- from a flat deadline to risk-differentiated timelines.

How Advisedly Helps

Advisedly's TRACE Score was purpose-built for exactly this problem: synthesizing asset context, threat intelligence, exploitability evidence, and compensating control data into a single prioritization score that maps directly to BOD 26-04's three-tier model. The platform ingests the KEV feed continuously, correlates findings against your asset inventory and network topology, and produces tier-assigned remediation queues automatically --- giving your team defensible prioritization without the manual classification burden. begin@advisedly.ai