The U.S. Cybersecurity and Infrastructure Security Agency (CISA) announced a new Binding Operational Directive, 26-04, that prioritizes security updates for Federal Civilian Executive Branch (FCEB) agencies.
The directive aims to reduce the threat of cyberattacks targeting the public sector by requiring agencies to remediate high-risk vulnerabilities within accelerated timeframes, in some cases as little as three days.
CISA says that BOD 20-04 “supersedes and revokes” the older BOD 19-02 and BOD 22-01, introduced in 2019 and 2021, respectively.
The agency says that prioritizing patching is based on four key considerations:
Whether the asset is publicly exposed online
