BOD 19-02, Vulnerability Remediation Requirements for Internet-Accessible Systems

Summary

Required agencies to fix critical vulnerabilities on internet-facing systems within 15 days and high vulnerabilities within 30 days of detection by CISA scanning, and to send CISA a remediation plan when they missed a deadline.

Read it on www.cisa.gov

Topics

• Vulnerabilities and patching

Replaces

• BOD 15-01, Critical Vulnerability Mitigation Requirement for Federal Civilian Executive Branch Departments and Agencies' Internet-Accessible Systems (superseded)

Replaced by

• BOD 26-04, Prioritizing Security Updates Based on Risk (in effect)

What FedXchange has recorded

No changes recorded. The watch records a new document and any change in its status.