--- title: BOD 26-04 Just Changed How Federal Agencies Prioritize... description: CISA's Binding Operational Directive 26-04, issued June 10, 2026, replaces BOD 19-02 and BOD 22-01 and requires federal civilian agencies to prioritize... canonical: https://daily.dev/posts/bod-26-04-just-changed-how-federal-agencies-prioritize-vulnerabilities--xtcnr8leu twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: BOD 26-04 Just Changed How Federal Agencies Prioritize Vulnerabilities. | daily.dev og:description: CISA's Binding Operational Directive 26-04, issued June 10, 2026, replaces BOD 19-02 and BOD 22-01 and requires federal civilian agencies to prioritize... og:url: https://daily.dev/posts/bod-26-04-just-changed-how-federal-agencies-prioritize-vulnerabilities--xtcnr8leu og:image: https://api.daily.dev/og/posts/XTCnR8leU.png og:image:alt: BOD 26-04 Just Changed How Federal Agencies Prioritize Vulnerabilities. og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # BOD 26-04 Just Changed How Federal Agencies Prioritize Vulnerabilities. **[Orca Security Blog](https://daily.dev/sources/orca-security-blog)** · 7 min read · 0 upvotes · 0 comments ## Summary CISA's Binding Operational Directive 26-04, issued June 10, 2026, replaces BOD 19-02 and BOD 22-01 and requires federal civilian agencies to prioritize vulnerability remediation using Stakeholder-Specific Vulnerability Categorization (SSVC) rather than raw CVSS scores. SSVC evaluates exploitation status, automatability, technical impact, and mission criticality to sort findings into five remediation tiers, with the most severe requiring action within three days plus forensic triage, down to deferral for low-risk cases. Full compliance is required by December 7, 2026, and FedRAMP has aligned its VDR/VER requirements to the same model, extending its reach to vendors. Orca Security has added a filter mapping findings to these five tiers in its Vulnerability Management view, with a dashboard widget planned. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CISA's BOD 26-04 and how does it change federal vulnerability patching requirements? BOD 26-04, issued by CISA on June 10, 2026, replaces BOD 19-02 and BOD 22-01 and requires federal civilian agencies to prioritize vulnerability remediation using SSVC (Stakeholder-Specific Vulnerability Categorization) instead of relying solely on CVSS severity scores. SSVC factors in active exploitation, automatability, technical impact, and mission criticality to assign remediation windows as short as three days, with full compliance required by December 7, 2026. _daily.dev surfaces directive changes like this so security teams can plan remediation workflows ahead of deadlines._ ### What are the four decision points in the SSVC model used by BOD 26-04? SSVC scores each vulnerability on four factors: exploitation status (none, proof-of-concept, or active), automatability of the attack's early stages (yes or no), technical impact (partial or total control), and mission and well-being criticality of the affected asset (low, medium, or high). These combine into an outcome of Act, Attend, Track*, or Track, determining how fast a fix is required. _teams weighing risk-based patching models can track how frameworks like SSVC evolve via daily.dev._ ### What is the deadline for federal agencies to fully comply with BOD 26-04's remediation timelines? Full compliance with BOD 26-04's remediation timelines is required by December 7, 2026, as part of Phase 3 of its rollout. Phase 1 required agencies to update vulnerability management policies and begin monitoring the KEV catalog immediately, while Phase 2 required aligning remediation processes to the SSVC model before the final compliance deadline. _security engineers tracking compliance deadlines like this one can follow directive updates on daily.dev._ ## Similar posts on daily.dev - [How CISA BOD 26-04 is reshaping the vulnerability remediation approach](https://daily.dev/posts/how-cisa-bod-26-04-is-reshaping-the-vulnerability-remediation-approach-flrbivlg9) · Dynatrace · 0 upvotes · 0 comments - [What is CISA BOD 26-04: Impact on vulnerability remediation](https://daily.dev/posts/what-is-cisa-bod-26-04-impact-on-vulnerability-remediation-bethgvuba) · Tenable Blog · 1 upvotes · 0 comments - [CISA tells agencies to patch smarter, not harder — foreshadowing broader industry practice](https://daily.dev/posts/cisa-tells-agencies-to-patch-smarter-not-harder-foreshadowing-broader-industry-practice-abzel1zsg) · CSO Online · 0 upvotes · 0 comments - [CISA tells govt agencies to patch critical exploited flaws in 3 days](https://daily.dev/posts/cisa-tells-govt-agencies-to-patch-critical-exploited-flaws-in-3-days-y4ewbawft) · BleepingComputer · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#compliance](https://daily.dev/tags/compliance) [View this post on daily.dev](https://daily.dev/posts/bod-26-04-just-changed-how-federal-agencies-prioritize-vulnerabilities--xtcnr8leu) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"BOD 26-04 Just Changed How Federal Agencies Prioritize Vulnerabilities.","url":"https://daily.dev/posts/bod-26-04-just-changed-how-federal-agencies-prioritize-vulnerabilities--xtcnr8leu","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/bod-26-04-just-changed-how-federal-agencies-prioritize-vulnerabilities--xtcnr8leu"},"datePublished":"2026-08-20T18:46:38.038Z","dateModified":"2026-08-20T18:47:59.393Z","description":"CISA's Binding Operational Directive 26-04, issued June 10, 2026, replaces BOD 19-02 and BOD 22-01 and requires federal civilian agencies to prioritize...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/af090e4a5a32e7dd325c1a657cda4a3f?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/af090e4a5a32e7dd325c1a657cda4a3f?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Orca Security Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Orca Security Blog","logo":"https://media.daily.dev/image/upload/s--kkQFNboJ--/f_auto,q_auto/v1780213281/logos/orca-security-blog?_a=BAMAMiWQ0","url":"https://daily.dev/sources/orca-security-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/bod-26-04-just-changed-how-federal-agencies-prioritize-vulnerabilities--xtcnr8leu","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,compliance","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Orca Security Blog","item":"https://daily.dev/sources/orca-security-blog"},{"@type":"ListItem","position":3,"name":"BOD 26-04 Just Changed How Federal Agencies Prioritize Vulnerabilities."}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/bod-26-04-just-changed-how-federal-agencies-prioritize-vulnerabilities--xtcnr8leu#faq","mainEntity":[{"@type":"Question","name":"What is CISA's BOD 26-04 and how does it change federal vulnerability patching requirements?","acceptedAnswer":{"@type":"Answer","text":"BOD 26-04, issued by CISA on June 10, 2026, replaces BOD 19-02 and BOD 22-01 and requires federal civilian agencies to prioritize vulnerability remediation using SSVC (Stakeholder-Specific Vulnerability Categorization) instead of relying solely on CVSS severity scores. SSVC factors in active exploitation, automatability, technical impact, and mission criticality to assign remediation windows as short as three days, with full compliance required by December 7, 2026. daily.dev surfaces directive changes like this so security teams can plan remediation workflows ahead of deadlines."}},{"@type":"Question","name":"What are the four decision points in the SSVC model used by BOD 26-04?","acceptedAnswer":{"@type":"Answer","text":"SSVC scores each vulnerability on four factors: exploitation status (none, proof-of-concept, or active), automatability of the attack's early stages (yes or no), technical impact (partial or total control), and mission and well-being criticality of the affected asset (low, medium, or high). These combine into an outcome of Act, Attend, Track*, or Track, determining how fast a fix is required. teams weighing risk-based patching models can track how frameworks like SSVC evolve via daily.dev."}},{"@type":"Question","name":"What is the deadline for federal agencies to fully comply with BOD 26-04's remediation timelines?","acceptedAnswer":{"@type":"Answer","text":"Full compliance with BOD 26-04's remediation timelines is required by December 7, 2026, as part of Phase 3 of its rollout. Phase 1 required agencies to update vulnerability management policies and begin monitoring the KEV catalog immediately, while Phase 2 required aligning remediation processes to the SSVC model before the final compliance deadline. security engineers tracking compliance deadlines like this one can follow directive updates on daily.dev."}}]} ```