CISA BOD 26-04: Frequently asked questions about the new risk-based patching directive

Tenable analyzes CISA's Binding Operational Directive (BOD) 26-04, which replaces BOD 22-01 with a four-variable, 16-tier risk model that prioritizes vulnerability remediation timelines—from three days with mandatory forensic triage for the highest-risk cases to deferral until the next system upgrade for low-risk issues. The report explains the four binary variables (public exposure, KEV status, exploit automation, and technical impact), describes operational and compliance impacts for federal agencies and the broader industry, highlights AI-driven acceleration of weaponization, and provides immediate recommendations for asset discovery, risk-based prioritization, and forensic readiness.