--- title: The 72-Hour Rule: CISA Just Turned Patch Management Into... description: CISA's Binding Operational Directive 26-04 (BOD 26-04), issued June 10, 2026, requires federal civilian agencies to remediate the highest-risk vulnerabilities... canonical: https://daily.dev/posts/the-72-hour-rule-cisa-just-turned-patch-management-into-a-ticking-clock-d9yn7xfqn twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The 72-Hour Rule: CISA Just Turned Patch Management Into a Ticking Clock | daily.dev og:description: CISA's Binding Operational Directive 26-04 (BOD 26-04), issued June 10, 2026, requires federal civilian agencies to remediate the highest-risk vulnerabilities... og:url: https://daily.dev/posts/the-72-hour-rule-cisa-just-turned-patch-management-into-a-ticking-clock-d9yn7xfqn og:image: https://api.daily.dev/og/posts/D9yn7xfqn.png og:image:alt: The 72-Hour Rule: CISA Just Turned Patch Management Into a Ticking Clock og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The 72-Hour Rule: CISA Just Turned Patch Management Into a Ticking Clock **[Security Boulevard](https://daily.dev/sources/securityboulevard)** · 12 min read · 0 upvotes · 0 comments ## Summary CISA's Binding Operational Directive 26-04 (BOD 26-04), issued June 10, 2026, requires federal civilian agencies to remediate the highest-risk vulnerabilities within 72 hours. The directive replaces older patching models (BOD 19-02 and BOD 22-01) and shifts the focus from abstract CVSS scores to real-world risk factors: internet exposure, presence in the Known Exploited Vulnerabilities Catalog, automation potential, and technical impact. While it formally binds only federal agencies, its specific timelines and risk criteria are likely to become a de facto standard of care in litigation, regulatory enforcement, insurance underwriting, and government contracting. Beyond patching, the directive implies forensic triage obligations — organizations must verify they weren't already compromised before the patch was applied. Asset inventory gaps, lack of compensating controls documentation, and absent risk-owner sign-off are all highlighted as legal liabilities. The piece argues that 'busy' is not a legal defense and that organizations unable to meet the 72-hour window must demonstrate a documented, defensible alternative response. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [CISA tells govt agencies to patch critical exploited flaws in 3 days](https://daily.dev/posts/cisa-tells-govt-agencies-to-patch-critical-exploited-flaws-in-3-days-y4ewbawft) · BleepingComputer · 0 upvotes · 0 comments - [CISA mulls new three-day remediation deadline for critical flaws](https://daily.dev/posts/cisa-mulls-new-three-day-remediation-deadline-for-critical-flaws-s4wlgrrhr) · CSO Online · 0 upvotes · 0 comments - [CISA tells agencies to patch smarter, not harder — foreshadowing broader industry practice](https://daily.dev/posts/cisa-tells-agencies-to-patch-smarter-not-harder-foreshadowing-broader-industry-practice-abzel1zsg) · CSO Online · 0 upvotes · 0 comments - [What is CISA BOD 26-04: Impact on vulnerability remediation](https://daily.dev/posts/what-is-cisa-bod-26-04-impact-on-vulnerability-remediation-bethgvuba) · Tenable Blog · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#compliance](https://daily.dev/tags/compliance) [View this post on daily.dev](https://daily.dev/posts/the-72-hour-rule-cisa-just-turned-patch-management-into-a-ticking-clock-d9yn7xfqn) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The 72-Hour Rule: CISA Just Turned Patch Management Into a Ticking Clock","url":"https://daily.dev/posts/the-72-hour-rule-cisa-just-turned-patch-management-into-a-ticking-clock-d9yn7xfqn","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-72-hour-rule-cisa-just-turned-patch-management-into-a-ticking-clock-d9yn7xfqn"},"datePublished":"2026-07-22T11:46:44.169Z","dateModified":"2026-07-22T11:47:10.569Z","description":"CISA's Binding Operational Directive 26-04 (BOD 26-04), issued June 10, 2026, requires federal civilian agencies to remediate the highest-risk vulnerabilities...","image":"https://media.daily.dev/image/upload/s--qPvKM23u--/f_auto/v1722860399/public/Placeholder%2009","thumbnailUrl":"https://media.daily.dev/image/upload/s--qPvKM23u--/f_auto/v1722860399/public/Placeholder%2009","isAccessibleForFree":true,"articleSection":"Security Boulevard","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Security Boulevard","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/3613c832180040de8d85bb29f74395be","url":"https://daily.dev/sources/securityboulevard"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-72-hour-rule-cisa-just-turned-patch-management-into-a-ticking-clock-d9yn7xfqn","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,compliance","timeRequired":"PT12M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Security Boulevard","item":"https://daily.dev/sources/securityboulevard"},{"@type":"ListItem","position":3,"name":"The 72-Hour Rule: CISA Just Turned Patch Management Into a Ticking Clock"}]} ```