)
)
)
)
Summary
CISA's binding operational directive BOD 26-04 retires severity-based patching for federal civilian agencies and replaces it with an exploit-evidence model that can demand fleet-wide remediation in as little as three days, no exceptions. Urgency now comes from four signals fed through a 16-row decision tree rather than a CVSS score, and the default flips from "give me a rationale to patch" to "justify why you can't." Automox CTO Jason Kikta expects the directive to filter down through federal contractors, cyber insurance, and board-level decisions the way the KEV catalog did. The real work is measuring your remediation SLA for actively exploited vulnerabilities, meeting it, and then driving it lower before the clocks tighten.
)
)
)
)