CISA's BOD 26-04, published on 10 June 2026, sets remediation urgency for federal civilian agencies using four variables: asset exposure, known exploited status, exploit automation and technical impact. It replaces a single deadline for all flaws with a risk based approach, a useful model for reading any patch time statistic.
What the directive says
The directive page describes the approach as focusing patching efforts on the areas of highest risk rather than treating all vulnerabilities and systems equally. It states that the urgency of remediation, shown in a table of remediation timelines, is determined by:
| Variable | Question it asks |
|---|---|
| Asset Exposure | Is the vulnerable asset publicly exposed? |
| KEV Status | Is the CVE on CISA's Known Exploited Vulnerabilities Catalog? |
| Exploit Automation | Can an adversary automate every step needed to exploit it? |
| Technical Impact | Does exploitation give partial or total control of the asset? |
CISA says it publishes answers on KEV status, exploit automation and technical impact for each CVE through services such as its Vulnrichment program (CISA).
The page also states that the directive supersedes BOD 19-02 and BOD 22-01. A Binding Operational Directive is compulsory for federal civilian executive branch agencies. It is not a rule for everyone else, so it is a model to learn from, not a requirement on a private company.
Why this matters when reading patch statistics
If urgency depends on four variables, then one average patch time for "all vulnerabilities" is a blend of very different clocks. A figure for internet exposed, known exploited, automatable flaws should be much shorter than a figure for an internal, low impact one. When a report does not separate these, its average cannot be compared with any single target.
Older reports also predate this change. Tenable's 2025 analysis, for instance, refers to the earlier BOD 22-01 due dates (Tenable). When you compare an old statistic with a current deadline, check which rule applied at the time.
Borrowing the idea for your own tiers
- Mark each asset as internet exposed or not.
- Check whether each finding is on the known exploited catalog (CISA).
- Note whether the exploit can be automated, if your advisory source says so.
- Note the technical impact: partial or total control.
- Give each combination its own target and report each tier separately.
What to avoid
Do not assume you must copy federal timelines, and do not quote the directive's table from memory. Read the current text for exact numbers.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at the signals that separate an urgent flaw from a routine one.
Quick check
Does BOD 26-04 apply to my company?
It binds federal civilian executive branch agencies. Private organizations may use it as a reference model, and your contracts or regulators may say otherwise, so check with your own advisers.
Why four variables instead of CVSS alone?
They combine exposure and exploitation evidence with impact, which a base severity score does not capture on its own.
Safeguard can help with the inventory side of this. Its SBOM and dependency scanning and reachability analysis show which vulnerable components you run and which your code actually calls. You can try the free scan at gold.safeguard.sh/scan.
Sources
- CISA, BOD 26-04: Prioritizing Security Updates Based on Risk
- CISA, Known Exploited Vulnerabilities Catalog
- Tenable, Verizon 2025 DBIR research collaboration on CVE remediation trends
Last reviewed: 19 October 2026.
