BOD 26-04, Prioritizing Security Updates Based on Risk

Summary

Requires agencies to fix vulnerabilities within 3 to 60 days based on risk factors such as KEV listing and internet exposure, tag exposed assets, keep CISA scanning access, and check high-risk systems for prior compromise.

Read it on www.cisa.gov

Topics

• Vulnerabilities and patching

Replaces

• BOD 19-02, Vulnerability Remediation Requirements for Internet-Accessible Systems (superseded)
• BOD 22-01, Reducing the Significant Risk of Known Exploited Vulnerabilities (superseded)

What FedXchange has recorded

No changes recorded. The watch records a new document and any change in its status.