CISA issues BOD 26-04 on security update prioritization
Original title: The Race Against the 3-Day Clock: How Rapid7 Helps Meet BOD 26-04 Compliance
CISA BOD 26-04 requires federal agencies to remediate actively exploited vulnerabilities granting full control in three days with mandatory forensic triage.
On June 10, 2026, CISA issued Binding Operational Directive 26-04, prioritizing security updates based on risk. For vulnerabilities that are actively exploited, publicly reachable, and grant total control, agencies have three calendar days to remediate. The directive supersedes prior BODs and uses four variables to classify risks into tiers with timelines from three days to 60 days. It mandates forensic investigation for Tier 1 vulnerabilities. The directive applies to federal civilian agencies and pushes compliance onto contractors and cloud providers.
- 3-day remediation for KEV + Total control vulns
- Mandatory 72-hour forensic triage for Tier 1
- Four risk variables replace static CVSS
- Applies to all Federal Civilian Executive Branch agencies
Impact: Patching and forensic triage for actively exploited vulnerabilities granting full control
| Product | Affected |
|---|---|
| CISA Binding Operational Directive 26-04 | — |
- 1.Patch within 3 days for Tier 1 vulnerabilities
- 2.Run concurrent forensic investigation
- 3.Isolate affected assets
- Vendors
- CISA
- Organizations
- Federal Civilian Executive Branch agencies
- Countries
- United States
From the original article
8 min read at rapid7.comIntroduction to BOD 26-04 On June 10, 2026, CISA issued Binding Operational Directive 26-04, "Prioritizing Security Updates Based on Risk."
By Rapid7 · rapid7.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.