CISA BOD 26-04: Frequently asked questions about the new risk-based patching directive

Tenable's analysis explains CISA BOD 26-04, which replaces the flat KEV-based deadlines of BOD 22-01 with a four-variable (public exposure, KEV status, exploit automation, technical impact) 16-tier remediation model that assigns timelines from three days (including forensic triage for the highest-risk cases) to fix-on-system-upgrade for the lowest-risk cases; the directive forces agencies to adopt continuous asset discovery, risk-based prioritization, and forensic readiness to meet aggressive compliance deadlines and respond to an AI-accelerated threat landscape.