Ask for written patch targets by severity, with a faster target for vulnerabilities that are being exploited. There is no single legal number for private buyers. CISA's older directive for federal agencies gave two weeks for most listed exploited flaws, which many buyers use as a reference point.
What CISA's directive said
CISA's BOD 22-01 required federal agencies to remediate catalog vulnerabilities within six months for CVEs assigned before 2021 and within two weeks for all others, with CISA able to adjust those defaults for grave risk. It covered software and hardware on federal systems, including those hosted by third parties on an agency's behalf. The page now states that the directive has been revoked and superseded by BOD 26-04, and the catalog entries point to that newer directive. Read the current text before you cite any timeline in a contract.
This is an obligation on agencies, not on vendors. It is still useful as an indicator of what a reasonable window looks like for known exploited flaws.
A clause structure that works
| Class of issue | What to ask the vendor to commit to |
|---|---|
| Actively exploited | Mitigation guidance or a fix in days, with proactive notice to you |
| Critical, not known exploited | A fix in a stated number of days |
| High | A fix in a longer stated window |
| Medium and low | Fixed in a regular release train |
Fill in the numbers with your own risk appetite and what the vendor can honestly meet. A commitment the vendor will miss is worse than a longer one it will keep.
Details that make the number meaningful
- When the clock starts. From vendor awareness, public disclosure, or fix availability? Name it.
- What counts as fixed. A patch available, or a patch you have deployed? For hosted services, deployed to production.
- Notification. How you hear about it, within what time, and through which channel.
- Workarounds. When no fix exists, the vendor supplies mitigations.
- Evidence. Advisories, release notes, and a way to see the history.
- Remedy. What happens on repeated misses: escalation, credits, or termination rights.
Check the track record first
Promises are cheap, so look at past behavior. Compare advisory dates with fix dates for the vendor's recent issues, and run the KEV check before you buy.
Try it yourself
Open the fix available now demo and look at how a fix version is surfaced next to a finding, which is the information a patch clause should guarantee you receive.
Click through it at your own pace, or open it full screen.
Quick check
Does the CISA two week window bind a private vendor?
No. It applied to federal agencies under that directive, which has since been replaced. Use it only as a reference point.
Should the SLA cover hosted services differently?
Yes. For a hosted service the vendor deploys the fix, so measure time to production rather than time to a published patch.
Safeguard's reachability analysis and fix PRs, which are off by default and kept on manual approval, help your own team meet patch windows, and you can try a free scan at gold.safeguard.sh/scan.
Sources
- CISA BOD 22-01, Reducing the Significant Risk of Known Exploited Vulnerabilities
- CISA Known Exploited Vulnerabilities Catalog
Last reviewed: 19 October 2026.
