CISA BOD 26-04 mandates three-day patching and forensic triage for federal agencies
TL;DR
CISA's Binding Operational Directive 26-04 gives federal agencies three calendar days to fix vulnerabilities in its two highest risk tiers. KEV-listed bugs that grant total control also need a mandatory forensic triage run in parallel; other exposed, automatable bugs granting total control get three days without it. The directive binds federal civilian agencies directly, and contractors and cloud providers handling federal data should expect the same timelines through their contracts.
What happened
On June 10, 2026, CISA issued BOD 26-04, replacing previous directives BOD 19-02 and BOD 22-01. The new policy moves away from static CVSS scores toward a dynamic risk model based on four variables: Asset Exposure, KEV status, Exploit Automation, and Technical Impact.
Under this directive, Tier 1 vulnerabilities, those listed in the Known Exploited Vulnerabilities (KEV) catalog that grant Total control, must be remediated within three days. This tier also carries a new, mandatory requirement: a concurrent forensic triage to check for existing compromises. Tier 2 vulnerabilities, which are publicly exposed, automatable, and grant Total control but are not yet on the KEV, also require a three-day turnaround, though without the mandatory forensic investigation. Lower tiers get 14 days, 60 days, or a fix on the next system upgrade, and CISA counts isolation, mitigation, and uninstalling the vulnerable software as valid remediation.
Why it matters
The 2026 Verizon Data Breach Investigations Report puts the industry median for full remediation at 43 days, far from the new 3-day mandate. According to Rapid7, attackers often establish persistence within hours of exploiting an exposed edge device, so a patch applied days later can leave an intruder already inside. Patching also reboots systems and overwrites the volatile memory that proves or disproves a compromise, so CISA's implementation guidance lays out a six-step, 72-hour protocol for Tier 1 triage. You must capture evidence like RAM and registries before applying patches, or you risk destroying the proof of a breach.
Who is affected
- Federal Civilian Executive Branch agencies, bound directly. National security systems and DoD/Intelligence Community systems are excluded.
- Supply-chain partners, which agencies must push compliance onto through contracts.
- Cloud Service Providers (CSPs) handling federal data, expected to adopt the same 3-day triage standard.
What to do now
- Identify all publicly reachable assets to determine your current exposure variables.
- Automate KEV ingestion, since a new listing can compress a 60-day clock to 3 days overnight.
- Develop a 72-hour forensic protocol that prioritizes capturing volatile data (RAM, cache, registries) before any patching occurs.
- Practice isolating infrastructure to contain threats without alerting attackers during the triage window.
- Hunt for IOCs, lateral movement, and data staging during every Tier 1 event, and report confirmed compromises to CISA.
- Contractors and cloud providers should review agency contracts for new remediation timelines.
What we don't know yet
- How quickly agencies will add the 3-day timelines to contractor and cloud contracts.
- The exact number of agencies currently failing to meet the 3-day window.
Sources
