CISA BOD 26-04 mandates three-day patching and forensic triage for federal agencies
CISA's Binding Operational Directive 26-04 gives federal agencies three calendar days to fix vulnerabilities in its two highest risk tiers. KEV-listed bugs that grant total control also need a mandatory forensic triage run in parallel; other exposed, automatable bugs granting total control get three days without it. The directive binds federal civilian agencies directly, and contractors and cloud providers handling federal data should expect the same timelines through their contracts.
2 min