Federal vulnerability management and breach response requirements in 2026: what is new, what is retired, and what still applies

Between April 2025 and June 2026, federal agencies replaced several core rules for vulnerability management and incident response. The Cybersecurity and Infrastructure Security Agency (CISA) replaced both of its patching directives with one risk-based directive. The Office of Management and Budget (OMB) replaced its 2021 logging memo. The National Institute of Standards and Technology (NIST) replaced its incident handling guide. Several older rules still apply unchanged, and some that agencies still cite are gone.

This guide maps the whole set: the law, the directives, the memos, and the standards an agency follows to find vulnerabilities, fix them, detect incidents, and respond to a breach. Each document links to its record in the FedXchange governance tracker, which shows its status and what it requires.

In short:

• New: Binding Operational Directive (BOD) 26-04 sets remediation deadlines of 3, 14, or 60 days based on risk. OMB memo M-26-14 sets new logging rules. NIST Special Publication (SP) 800-61 Revision 3 is the current incident response guide. BOD 26-02 requires agencies to replace unsupported edge devices.
• Retired: BOD 22-01 and BOD 19-02 (replaced by BOD 26-04), M-21-31 (replaced by M-26-14), and SP 800-61 Revision 2 (replaced by Revision 3).
• Still in force: the Federal Information Security Modernization Act of 2014 (FISMA), BOD 23-01 on asset discovery and scanning, BOD 20-01 and M-20-32 on vulnerability disclosure, M-22-01 on endpoint detection and response, BOD 18-02 on high value assets, M-17-12 on breaches of personal information, and CISA's incident notification guidelines.
• Still pending: the final rule under the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA).

The law underneath all of it

FISMA is the foundation. It makes OMB responsible for agency security policy, makes the Department of Homeland Security (through CISA) responsible for carrying it out, and gives CISA the power to issue binding operational directives that federal civilian agencies must follow. It also requires agencies to run risk-based security programs and to report major incidents to Congress. Every directive in this guide rests on that authority.

Finding vulnerabilities

Asset discovery and scanning. BOD 23-01, issued October 3, 2022, with requirements in effect since April 3, 2023, requires federal civilian agencies to run automated discovery of the devices on their networks every 7 days, scan those devices for vulnerabilities every 14 days, and report the results to CISA. It is still active, and the newer directives build on it: BOD 26-04 cannot work without an accurate inventory.

Endpoint detection and response. OMB memo M-22-01 requires agencies to deploy endpoint detection and response tools in coordination with CISA and to give CISA the access it needs to hunt for threats on agency endpoints.

Reports from the public. BOD 20-01 and M-20-32, both issued September 2, 2020, require each agency to publish a vulnerability disclosure policy that invites the public to report security flaws in good faith, handle the reports, widen the policy until it covers every internet-facing system, and report metrics to CISA. CISA's Vulnerability Disclosure Policy Platform is a shared service agencies can use for this. NIST SP 800-216 (May 2023) recommends how to receive, assess, coordinate, and resolve those reports.

Unsupported edge devices. BOD 26-02 (February 5, 2026) is new. It requires agencies to inventory the devices on CISA's end-of-support edge device list within three months; within twelve months, remove listed devices that have already reached end of support and inventory edge devices that will reach it in the next year; then remove every identified unsupported edge device; and finally set up continuous discovery of edge devices so each one is removed before it reaches end of support. A device that no longer gets security updates cannot be fixed on any deadline, so this directive closes a gap the patching rules leave open.

Prioritizing and fixing: BOD 26-04

BOD 26-04, "Prioritizing Security Updates Based on Risk", issued June 10, 2026, is the biggest change in this guide. It revoked and replaced two directives:

• BOD 19-02 (2019), which required agencies to fix critical vulnerabilities on internet-facing systems within 15 days and high vulnerabilities within 30 days, based on severity scores.
• BOD 22-01 (2021), which created the Known Exploited Vulnerabilities (KEV) catalog and required agencies to fix each listed vulnerability by the date CISA set: by default two weeks, or six months for vulnerabilities whose Common Vulnerabilities and Exposures (CVE) identifiers were assigned before 2021.

Instead of a severity score or a single KEV deadline, BOD 26-04 judges each vulnerability by four factors. CISA says its remediation table is informed by Stakeholder-Specific Vulnerability Categorization (SSVC), CISA's method for triaging vulnerabilities, so a Common Vulnerability Scoring System (CVSS) score no longer sets the deadline:

1. Is the affected asset exposed to the internet?
2. Is the vulnerability listed in the KEV catalog?
3. Can exploitation be automated?
4. Would exploitation give an attacker total control of the system, or only partial control?

The combination sets the deadline. CISA's implementation guidance maps all sixteen combinations to a deadline. The tier names below are FedXchange's shorthand, not CISA's:

Forensic triage, for the highest tier, means fixing the vulnerability within three days and also checking the asset for signs that it was already compromised, following the forensic triage guidance in CISA's implementation guidance.

When the clock starts. The deadline starts when CISA adds the vulnerability to the KEV catalog, or when the agency finds it on an asset and records it on the Continuous Diagnostics and Mitigation (CDM) dashboard, whichever comes first. Deadlines change as the facts change: taking a system off the internet moves it to a longer deadline, and a new KEV listing moves it to a shorter one.

The KEV catalog itself remains. It is now one of the four risk factors rather than a deadline on its own.

The milestones. The directive has three phases:

• Immediately: update vulnerability management policies, including a process for fixing KEV-listed vulnerabilities on CISA's deadlines; report the status of KEV-listed vulnerabilities through the CDM dashboard, or manually every two weeks if reporting is not automated; keep CISA's Cyber Hygiene scanning in place; and confirm the agency's publicly exposed IP addresses and domain names to CISA every quarter.
• Within 60 days (August 9, 2026): update vulnerability management processes and procedures to cover vulnerabilities in the CVE database and the KEV catalog.
• Within 180 days (December 7, 2026): fix every vulnerability within the deadlines above, and continuously tag every agency-owned asset that can be reached from outside the agency network with its organization, environment, exposure, and asset type. Agencies that do not report automatically through CDM must send this to CISA every seven days.

When a fix cannot be made in time. CISA's implementation guidance says CISA does not issue waivers or exceptions for directives. If an agency cannot apply the required fix in time, it must remove the asset from the network or isolate it, for example by decommissioning it, removing the vulnerable software, or segmenting the network. Special cases go to CISA at CyberDirectives@cisa.dhs.gov.

Systems run by contractors and cloud providers. BOD 26-04 covers every federal information system, including those operated on an agency's behalf. For systems hosted by third parties, including FedRAMP-authorized cloud services, the agency must keep an inventory, get status updates from the provider, and make sure the requirements are met. The directive does not bind contractors directly unless their contract says so, so agencies must review their contracts with the contracting officer and change them where needed.

Planning the patching. NIST SP 800-40 Revision 4 (April 2022) treats patching as preventive maintenance and guides agencies in setting an enterprise patch management strategy. It replaced Revision 3, which was a guide to patching technologies.

Emergency directives. When a vulnerability is being exploited at scale, CISA issues an emergency directive (ED) with its own, shorter deadlines. Recent ones still in force include ED 26-01 for F5 devices (October 2025), ED 25-03 for Cisco devices (September 2025), and ED 26-03 for Cisco software-defined wide area network systems (February 2026). An emergency directive applies on top of BOD 26-04, not instead of it.

High value assets. BOD 18-02 still requires agencies to identify their high value assets, support CISA's assessments of them, and fix major or critical weaknesses within 30 days of an assessment or send a remediation plan.

Detecting incidents: logging under M-26-14

OMB memo M-26-14, issued May 22, 2026, replaced M-21-31. M-21-31 had set a four-tier maturity model and long lists of log types with set retention periods. Many agencies struggled to meet it.

M-26-14 is built around two goals: detecting threats in real time and investigating incidents afterward. It requires each agency to submit an Agency Logging Plan to OMB and CISA within 90 days of CISA publishing its logging reference architecture. CISA published the architecture on August 20, 2026, so logging plans are due November 18, 2026. Logs must be searchable for at least six months and retrievable for a year, and must carry accurate timestamps.

M-26-14 also sets its own maturity model, measured from the architecture's release:

Responding to an incident

Report within one hour. CISA's Federal Incident Notification Guidelines, in effect since April 1, 2017, tell agencies to report computer security incidents to CISA within one hour of identifying them, using standard impact categories and attack vectors.

Report major incidents to Congress. FISMA requires agencies to notify Congress of major incidents and leaves the definition to OMB. OMB's annual FISMA guidance, currently M-25-04, defines a major incident as an incident, or a breach of personally identifiable information, that is likely to result in demonstrable harm to national security, foreign relations, or the economy of the United States, or to public confidence, civil liberties, or public health and safety. An agency must notify the appropriate congressional committees and its Office of Inspector General no later than seven days after it determines it has a reasonable basis to conclude a major incident has occurred, and update that notice as it learns more.

Follow the playbooks. CISA's incident and vulnerability response playbooks (November 2021), required by Executive Order 14028, give federal civilian agencies standard steps for major incidents and for vulnerabilities being actively exploited.

Use the current NIST guide. NIST SP 800-61 Revision 3 (April 2025) replaced Revision 2. It drops the old incident handling life cycle and organizes its recommendations around the six functions of the Cybersecurity Framework (CSF) 2.0, so incident response is part of an agency's overall risk management rather than a separate process. Incident response plans and procedures that still cite Revision 2 need updating.

Know who coordinates a significant incident. Presidential Policy Directive 41 (2016) still sets the roles: the Department of Justice leads threat response, the Department of Homeland Security leads asset response, and the Director of National Intelligence leads intelligence support.

National security systems. National Security Presidential Memorandum 12 (June 12, 2026) sets new national policy for national security systems. It directs the National Manager for National Security Systems to recommend new incident reporting standards and directs agencies to update their incident response policies to match. It replaced National Security Directive 42 and National Security Memorandum 8.

Responding to a breach of personal information

OMB memo M-17-12 (January 3, 2017) is still the governing rule for breaches of personally identifiable information. It replaced four earlier memos from 2006 and 2007. It requires each agency to:

• keep a breach response plan;
• run a breach response team led by the Senior Agency Official for Privacy;
• test the plan at least once a year; and
• assess the risk of harm to individuals when deciding whether to notify them and what help to offer.

OMB memo M-16-14 directs agencies to buy identity protection services, such as credit monitoring, through a government-wide contract when a breach calls for them.

Contractors and critical infrastructure

Defense contractors must report cyber incidents to the Department of Defense within 72 hours under the Defense Federal Acquisition Regulation Supplement clause 252.204-7012.

Civilian contractors do not yet have a single incident reporting clause. The Federal Acquisition Regulation (FAR) proposed rule on cyber threat and incident reporting, published in October 2023, is still a proposal.

Critical infrastructure. CIRCIA will require covered critical infrastructure entities to report substantial cyber incidents to CISA within 72 hours and ransom payments within 24 hours, once CISA's final rule takes effect. CISA published the proposed rule in April 2024. It missed its target of September 2026 for the final rule, and on October 1, 2026 the final rule went to the Office of Information and Regulatory Affairs (OIRA) at OMB for review, the last major step before publication. No final rule had been published as of October 31, 2026.

What else is coming

Executive Order 14409 (June 2, 2026) directs CISA to issue binding operational directives to speed up civilian agency cyber defense, creates a clearinghouse for using artificial intelligence to find and patch vulnerabilities, and expands hiring paths for federal cybersecurity specialists. BOD 26-04 itself says it advances the priorities in this order, and more directives may follow.

Old and new at a glance

What to check now

• Your vulnerability management policy and procedures cite BOD 26-04, not BOD 22-01 or BOD 19-02.
• Your asset inventory tags every agency-owned asset reachable from outside the agency network (organization, environment, exposure, asset type), so each vulnerability can be placed in a BOD 26-04 tier, and you confirm your exposed IP addresses and domain names to CISA each quarter.
• You report the status of KEV-listed vulnerabilities through the CDM dashboard, or manually every two weeks.
• You can do forensic triage within three days for the highest tier.
• You know how you will remove or isolate an asset you cannot fix in time, since CISA grants no waivers.
• Your contracts with cloud and system providers let you get the status updates BOD 26-04 requires.
• You are on track to meet BOD 26-04's deadlines by December 7, 2026.
• Your Agency Logging Plan, due November 18, 2026, follows M-26-14 and CISA's logging reference architecture, and nothing still cites M-21-31.
• Your incident response plan cites NIST SP 800-61 Revision 3.
• Your breach response plan under M-17-12 has been tested in the last year.
• You have a plan to replace unsupported edge devices under BOD 26-02.

FedXchange tracks every one of these documents and the actions they require. When one changes, the governance tracker and the deliverables calendar change with it.

Sources

• Federal Information Security Modernization Act of 2014
• CISA, BOD 26-04: Prioritizing Security Updates Based on Risk and its implementation guidance
• CISA, BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks
• CISA, BOD 26-02: Mitigating Risk From End-of-Support Edge Devices
• CISA, BOD 20-01: Develop and Publish a Vulnerability Disclosure Policy
• CISA, BOD 18-02: Securing High Value Assets
• OMB, M-26-14: Ensuring Effective and Efficient Agency Logging and Network Visibility
• CISA, Logging Reference Architecture
• OMB, M-25-04: Fiscal Year 2025 Guidance on Federal Information Security and Privacy Management Requirements
• OIRA review record for the CIRCIA final rule (RIN 1670-AA04)
• OMB, M-17-12: Preparing for and Responding to a Breach of Personally Identifiable Information
• OMB, M-22-01: Improving Detection of Cybersecurity Vulnerabilities and Incidents through Endpoint Detection and Response
• NIST SP 800-61 Revision 3 and NIST SP 800-40 Revision 4
• CISA, Federal Incident Notification Guidelines
• CIRCIA proposed rule, April 4, 2024
• Executive Order 14409