A vulnerability remediation SLA is a deadline to fix or mitigate a finding, set by risk tier. Make the shortest clock apply to known exploited vulnerabilities on exposed assets, and longer ones to the rest. CISA's directives show the model: BOD 22-01 used two weeks for most KEV items, and BOD 26-04 now sets deadlines from risk factors.
Key takeaways
- Tie deadlines to risk factors, not a single severity label.
- Define when the clock starts and what counts as done.
- Allow exceptions, but with an owner, a reason and an expiry date.
- We did not find a single standard day count that applies to every organization, so set yours and review it yearly.
What did CISA require before?
BOD 22-01 required KEV catalog vulnerabilities to be fixed "within six months for vulnerabilities with a CVE ID assigned prior to 2021" and "within two weeks for all other vulnerabilities". It allowed adjustment for grave risk. BOD 22-01 is now revoked and superseded.
What does CISA require now?
BOD 26-04, issued on 10 June 2026, replaces BOD 22-01 and BOD 19-02. It sets timelines in a table using four factors: asset exposure, KEV status, exploit automation and technical impact. Days are calendar days. The clock starts when CISA adds the CVE to KEV or when the agency finds it on an asset, whichever comes first.
Timelines are dynamic. A new KEV listing shortens a deadline, and removing an asset from the internet can extend it. The directive applies to federal civilian agencies, with phases at immediate, 60 and 180 days. We could not read the numeric table, so we do not quote day counts.
What should my SLA tiers look like?
Use the same factors in a simple grid. Fill in the days that fit your team.
| Tier | Condition | Deadline |
|---|---|---|
| 1 | KEV listed or active exploitation, asset exposed to the internet | Your shortest clock |
| 2 | KEV listed, internal asset; or high EPSS, exposed asset | Short clock |
| 3 | Automatable and total technical impact, no exploitation seen | Standard clock |
| 4 | Everything else | Routine patch cycle |
CISA's SSVC outcomes give similar tiers: Track, Track star, Attend and Act.
What else belongs in an SLA policy?
- Clock start: detection date or advisory date, stated clearly.
- Definition of done: fixed, mitigated, or accepted with approval, and rescanned.
- Ownership: one named team per asset.
- Exceptions: reason, compensating control and expiry date.
- Reporting: share of findings fixed inside the deadline, by tier.
- Review: reassess annually. CISA commits to reassessing its own timelines annually.
How do I track it?
Record detection date and due date on every finding, then report the share closed in time. A spreadsheet is enough at first. Move to a platform when the volume grows.
Try it yourself
Take your last 20 closed findings. Compute days from detection to fix and compare with the tier each would have had. The gaps show where your clocks are unrealistic or ignored.
Click through it at your own pace, or open it full screen.
Frequently asked questions
What is a good SLA for critical vulnerabilities?
There is no universal number in the sources we read. Make it your shortest clock and apply it to exploited, exposed assets first.
When does the SLA clock start?
Define it in policy. BOD 26-04 starts the clock at the earlier of a KEV listing or the agency finding the CVE on an asset.
Can an SLA be extended?
Yes, through a documented exception with an owner and expiry. BOD 26-04 also lets exposure changes extend a deadline.
Does mitigation count as remediation?
Only if your policy says so. Removing exposure is treated as a legitimate way to change a deadline in BOD 26-04, but a flaw may remain.
Are CISA deadlines binding on private companies?
No. BOD 26-04 applies to federal civilian agencies. Private teams can borrow the method.
Sources
- CISA BOD 22-01 (revoked): https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities
- CISA BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- CISA SSVC: https://www.cisa.gov/stakeholder-specific-vulnerability-categorization-ssvc
- CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Last reviewed: 19 October 2026.
