CISA ties federal patch deadlines to four yes-or-no questions about each CVE

Four questions with two answers each produce sixteen possible risk profiles ^[13], and CISA answers three of the four before an agency looks at anything. KEV status, exploit automation and technical impact are published per CVE ID through services including the Vulnrichment Program ^[10]. The remaining variable, whether the vulnerable asset is publicly exposed, is the agency's own determination, made against CISA's Internet Exposure Reduction Guidance ^[11]. One of the four inputs is owned locally ^[14].

Enrichment data cannot know what an agency has facing the public internet. An inventory that records an internet-facing appliance as internal moves every CVE on that appliance into a slower tier, and the mistake is invisible in the CVE feed, because the feed is correct and the asset record is not.

BOD 22-01 in 2021 pointed agencies at the Known Exploited Vulnerabilities catalog and told them to remediate aggressively ^[2]. 26-04 keeps that urgency for high-risk items and adds deferral of low-risk ones ^[3], with CISA describing the approach as focusing effort on the areas of highest risk rather than treating all vulnerabilities and systems equally ^[4]. A program that formally deprioritizes a CVE now does so with a compulsory directive behind it.

BOD 26-04 binds Federal Civilian Executive Branch agencies ^[7] and does not apply to statutorily defined national security systems or to certain systems operated by the Department of War or the Intelligence Community ^[8]. Nothing in it obliges a vendor, a contractor or a private enterprise. What crosses that boundary is the data: any organization can pull the same three published answers per CVE ^[10] and run the same tiering, without any obligation to do so.

CISA's stated reason for changing the model is that threat actors exploit unpatched vulnerabilities, and that their use of AI may further narrow the time defenders have between patch release and possible exploitation ^[5]. CISA frames that as a possibility rather than a confirmed measurement. The directive is aligned to OMB Circular A-130 and FISMA, and CISA has issued separate implementation guidance for agencies working through it ^[12].

For federal teams the deadline now comes out of four fields, three delivered by CISA and one produced by whatever the asset inventory says ^[14]. Inventory accuracy has become a scheduling control.