The US Cybersecurity and Infrastructure Security Agency issued Binding Operational Directive 26-04 on 10 June 2026, changing how fast federal agencies must fix vulnerabilities [1].
It revokes the directives that set the old rules, BOD 22-01 and BOD 19-02, and makes remediation deadlines depend on risk, such as whether a system is exposed to the internet [1].
For vulnerabilities that meet its threshold, agencies must act in fewer than three days and carry out a forensic check of whether systems were already compromised [2].
What it covers
Federal civilian executive branch agencies. National security systems and certain Department of War and intelligence systems are excluded [1].
Agencies had 60 days to update their procedures and 180 days to begin remediating to the new timelines, and must tag every internet-facing asset [1].
The change shows in CISA's catalogue of exploited flaws. In 2025 almost every new entry had a 21-day deadline. In September 2026, 33 of 41 new entries had 3 days, and 8 had 14 [3].
What it does not tell you
Whether agencies meet the deadlines. CISA will report on implementation at the end of each fiscal year [1].
It binds only federal civilian agencies, not companies or other governments [1].
Comments