Federal civilian agencies now face patch deadlines set by risk rather than by a severity score. CISA issued Binding Operational Directive 26-04 on June 10, 2026, and it ties the speed of each fix to how dangerous the flaw is in practice.
Small businesses are not bound by the order. Still, CISA urges every organization to take a risk-based approach and to fix flaws from its Known Exploited Vulnerabilities (KEV) catalog first. The model is simple enough for a small IT team to borrow.
Key facts
- BOD 26-04 replaces and cancels two older directives, BOD 19-02 from April 29, 2019, and BOD 22-01 from Nov. 3, 2021.
- Four questions set the deadline: Is the asset exposed to the public? Is the CVE in the KEV catalog? Can the attack be automated? Does the attacker gain partial or total control?
- Agencies no longer have to rank flaws by CVSS score, and labels such as "critical" or "high" no longer map to set actions.
- A KEV flaw on a public asset that can be exploited automatically and gives total control carries a 3-day deadline.
- Agencies must start fixing flaws on the new timelines by December 7, 2026.
Background
CISA launched the KEV catalog in 2021 under BOD 22-01, which pushed agencies to move fast on flaws known to be under attack. The new directive folds that work and the older scoring rules into one set of federal remediation guidelines.
A flaw lands in the catalog only after three tests are met, according to CISA. It must have a CVE ID, there must be solid proof that attackers are using it, and there must be a clear fix, such as a vendor update. CISA tries to add a qualifying flaw within 24 hours of spotting it, though extra research or a missing mitigation can slow that down.
The pace matters. CISA warns that attackers go after unpatched flaws, and that their use of AI may shrink the window between a patch release and an attack even further. A recent example: on October 26, 2026, CISA added two PHP flaws, CVE-2026-109618 and CVE-2026-109619, to the catalog.
The rollout runs in phases. Agencies get 60 days from issuance to update their procedures in Phase II. Within 180 days, in Phase III, they must fix each flaw no later than the limits in the directive's Table 1. FedRAMP says agency policies needed to support ongoing remediation by August 7, 2026.
What it means for you
The directive covers Federal Civilian Executive Branch agencies. It does not reach contractors unless a procurement contract says so, but agencies must review every contract to see what changes compliance requires. Whether a given small vendor's contract will pick up the rules is not yet known.
Cloud providers feel it more directly. FedRAMP says the monthly scanning that most Rev5 certified cloud services still use falls short under BOD 26-04. It will make its Vulnerability Detection and Response and Vulnerability Evaluation and Reporting rules mandatory for certified services on December 7, 2026, with a grace period through March 7, 2027. After that date, offerings that do not follow the new rules will lose certification. FedRAMP had first planned the switch for June 1, 2027, with a grace period to January 1, 2028, before the directive pulled it forward.
If a business relies on software as a service, it still owns part of the risk. CISA's guidance says the provider covers web application security, identity, operations and network protection. The customer stays responsible for access and sign-in, its own data and content, and audit logs.
For everyone else, the message is voluntary but clear. CISA says state, local, tribal and territorial governments and private companies are not bound by the order, yet they can improve their defenses by putting KEV flaws first. A team that has sorted its patch list by severity score alone can learn from the switch. Our cybersecurity services can help a business set up that kind of risk-based review.
Practical steps
These steps come from CISA's own advice and scale down to a small office.
- Write the rule down. CISA says each organization should add a requirement to its vulnerability plan to handle KEV flaws right away, and should look at patch tools that flag KEV entries on their own.
- Know what faces the internet. Agencies must label each internet-reachable asset by organization and sub-group, environment such as production or development, exposure as public or internal, and type such as server, application or network device. A small team can keep the same simple inventory. The checklist in our IT documentation guide is a good place to start.
- Follow the vendor fix. For each KEV entry, CISA's listed action is to apply the vendor's update as directed, or pull the product off the network if it is end-of-life or cannot be updated.
- Isolate what cannot be patched in time. CISA says to take the asset off the network. Options include retiring it, removing the weak software, network segmentation, software-defined perimeters and proxies.
- Ask the vendor about embedded parts. When a flawed component sits inside another company's product with no patch, CISA advises contacting that vendor directly for a fix or guidance.
- Check for a break-in on the fastest cases. Where Table 1 calls for forensic triage, an agency must fix or mitigate within three days and also check whether the asset was already compromised.
- Get alerts. CISA offers email updates when new flaws join the catalog.
Teams that would rather not run this alone can lean on managed IT services for patching and monitoring. Cloud workloads can be reviewed under our cloud and infrastructure work.
What happens next
CISA will reassess the Table 1 timelines once each fiscal year using data, and report status to DHS, OMB and the National Cyber Director at year's end. It is not known whether that review will shorten or change the limits.
CISA's CDM program office is talking with scanning suppliers, including Tenable and Qualys, about what features customers need. CISA's guidance says the aim is to determine what, if any, additional features are needed.
