CISA BOD 26-04: Frequently asked questions about the new risk-based patching directive

CISA issued BOD 26-04, replacing BOD 22-01 with a four-variable, risk-based model that sets graduated remediation timelines, including patching the highest-risk vulnerabilities in as few as three days with mandatory forensic triage and allowing deferral for lowest-risk issues. It cites declining KEV remediation rates and AI speeding exploit weaponization.