> ## Content Index
> Fetch the complete content index at: https://thecyberstories.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Patch by risk, not by score: what CISA's new directive teaches every IT team
- URL: https://thecyberstories.com/cisa-bod-26-04-patch-by-risk-2/
- Published: 2026-11-03T04:29:09.000Z
- Updated: 2026-11-03T04:29:09.000Z
- Description: CISA has replaced its old patching rules for US federal agencies with a risk-based system built on four questions. You don't have to be a government agency to borrow it. Here are the four questions, what each one means, and how any IT team can use them to decide what to patch first.
- Author: Raja Sekhar Thota
- Tags: Enterprise Security, #csv-6ae9612cbb92540f93998eab, #Import 2026-11-03 16:27

## In brief

For years, the US government's patching rules said, roughly: fix internet-facing critical bugs fast, and fix anything on CISA's "known exploited" list by a deadline. In June, CISA replaced both rules with one that asks a smarter question: how much risk does this flaw create on *this* system? It's written for US federal agencies, but it's one of the best free patching playbooks any IT team can borrow.

## What changed?

Binding Operational Directive 26-04, issued on June 10, 2026, [focuses patching efforts on the areas of highest risk rather than treating all vulnerabilities and systems equally](https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk?ref=thecyberstories.com). It [revokes BOD 19-02 and BOD 22-01](https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk?ref=thecyberstories.com), the two rules it replaces.

CISA's reason is speed. It warns that attackers' [use of AI may further narrow the time defenders have to react](https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk?ref=thecyberstories.com) between a patch being released and attacks starting.

## The four questions

Urgency comes from four questions:

1. **Exposure:** can people on the internet reach the vulnerable system?
2. **Known exploited:** is the flaw on CISA's Known Exploited Vulnerabilities list?
3. **Automation:** [can an attacker automate every step needed to exploit it](https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk?ref=thecyberstories.com)? If yes, attacks can run at scale.
4. **Impact:** does the attacker [gain partial control or total control](https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk?ref=thecyberstories.com) of the system?

CISA publishes answers to the last three for every published vulnerability. Your team supplies the first: is it exposed?

## From three days to the next upgrade

At the urgent end, agencies must fix the flaw within [three days and carry out a forensic triage](https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk?ref=thecyberstories.com): check whether the system was already compromised. That's a recognition that, for the worst bugs, patching late means checking for intruders too.

At the other end, low-risk flaws can wait until [the next scheduled major upgrade or rebuild](https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk?ref=thecyberstories.com). That frees people to work on what matters.

The timeline also moves with the facts. Taking a system off the internet is [a valid mitigation](https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk?ref=thecyberstories.com) that pushes its deadline back; a flaw newly added to the exploited list pulls it forward. Agencies have [180 days](https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk?ref=thecyberstories.com) to start meeting the new timelines.

## Who does it apply to?

US federal civilian agencies. It [does not apply to contractors](https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk?ref=thecyberstories.com) unless their contract says so. But the logic travels well, including to Indian businesses that have been patching by severity score alone.

## How to borrow it

- **Know what's exposed.** Keep a current list of every system reachable from the internet. Without it, the first question can't be answered.
- **Watch the exploited list.** Subscribe to CISA's KEV catalog updates and treat a match on an exposed system as an emergency.
- **Ask whether it gives partial or total control.** A flaw that hands over the whole system outranks one that leaks a little.
- **Check for compromise on the worst ones,** not just patch them.
- **Write down what can wait,** and fold it into planned upgrades.

## Sources

- [BOD 26-04: Prioritizing Security Updates Based on Risk (CISA, June 10, 2026)](https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk?ref=thecyberstories.com)