Meet CISA BOD 26-04 Requirements

CISA Binding Operational Directive (BOD) 26-04 establishes a risk-based approach for Federal Civilian Executive Branch (FCEB) agencies to prioritize security updates and remediate vulnerabilities based on real-world threat activity and potential technical impact.

The directive addresses the increasing exploitation of unpatched vulnerabilities and the shrinking window between vulnerability disclosure and active exploitation. It builds on BOD 22-01 and the CISA Known Exploited Vulnerabilities (KEV) Catalog.

BOD 26-04 requires agencies to continuously identify and monitor agency-owned assets, track vulnerabilities listed in the KEV Catalog, and remediate vulnerabilities according to the applicable remediation timelines. Agencies must also maintain asset information, including organization, environment, exposure, asset type, and associated IP addresses, and track and report compliance to CISA as required.

CISA BOD 26-04 support in ETM is available on request. Contact Qualys Support or your Technical Account Manager (TAM) to turn it on for your subscription.

Qualys Support for CISA BOD

Qualys VMDR and Enterprise TruRisk Management (ETM) helps security teams operationalize the directive by incorporating CISA's risk factors into vulnerability prioritization and remediation workflows. Qualys evaluates:

  • Asset Exposure — whether the vulnerable asset is publicly exposed.
  • CISA KEV — whether the CVE is listed in the CISA Known Exploited Vulnerabilities Catalog.
  • Automatable — whether an adversary can automate the steps required to exploit the vulnerability.
  • Technical Impact — the level of control an adversary can gain over the vulnerable software or information after successful exploitation.

Based on these factors, Qualys determines the applicable CISA BOD 26-04 remediation timeline and SLA status, helping security teams identify vulnerabilities requiring immediate remediation and track findings that are within SLA, nearing SLA, or out of SLA.

Qualys provides BOD 26-04 dashboards, risk-based filtering, vulnerability/finding listings, SLA tracking, and remediation worklists, enabling security and IT teams to identify affected assets, prioritize high-risk findings, monitor remediation progress, and measure compliance.

For findings requiring Forensic Triage, Qualys identifies such findings/vulnerabilities, so security teams can initiate a focused investigation to determine whether exploitation or compromise has occurred. CISA's guidance describes forensic triage as a rapid investigation involving scoping, evidence preservation, stabilization, containment, analysis, and escalation.

Together, these capabilities help organizations translate CISA's risk-based guidance into actionable vulnerability prioritization, remediation tracking, and continuous security monitoring. For more information, refer to BOD 26-04: Prioritizing Security Updates Based on Risk.

In ETM, you see CISA BOD 26-04 data in these places:

Key Terms and Concepts

  • BOD 26-04 prioritizes vulnerabilities using four factors: asset exposure, KEV status, exploit automation, and technical impact. Use these definitions as you read the rest of this guide.
  • Asset: The hardware or software items that make up your information system.
  • Asset exposure: Whether the vulnerable asset is publicly exposed.
  • Publicly exposed: Any IT resource you own or manage that unauthenticated or untrusted entities can reach over a public network, such as the internet, regardless of where the resource sits physically or logically.
  • KEV status: Whether the vulnerability's CVE ID appears on CISA's Known Exploited Vulnerabilities (KEV) Catalog.
  • Exploit automation: Whether an attacker can automate every step needed to exploit the vulnerability.
  • Technical Impact: Indicates how much control an attacker can gain over a vulnerable asset after successfully exploiting a vulnerability. 
    • Partial: The attacker gains limited control or access to information. Security restrictions may prevent full compromise, and attacks such as denial-of-service (DoS) are considered to have a partial impact.
    • Total: The attacker gains complete control of the affected system or software. This can include running arbitrary code, performing any action the vulnerable component allows, obtaining full administrative privileges, or stealing credentials.
  • Remediation SLA: The number of days VMDR allows for remediation under a finding's applicable service level agreement (SLA) profile, based on the finding's asset exposure, KEV status, exploit automation, and technical impact.
  • Forensic triage: A rapid, focused investigation of an affected asset to determine whether an attacker exploited the vulnerability or compromised the system.

Related Topics

 

© 2026 Qualys, Inc. All rights reserved. Privacy Policy. Last updated: October, 2026