BOD 26-04 and FedRAMP's December 7 Deadline: What Contractors and SaaS Providers Should Prepare

On December 7, 2026, federal civilian agencies must start remediating vulnerabilities on the timelines in CISA's Binding Operational Directive 26-04 (opens in a new tab). The same day, FedRAMP makes its new vulnerability rules mandatory for every cloud service seeking or keeping certification. If you sell software, hosting, or managed services to federal agencies, those dates are about seven weeks away.

The short answer: for every system that touches federal work, be able to show which assets are internet-facing, which vulnerabilities are known to be exploited, how fast you fix them, and how you check whether an attacker got in before the fix.

What is CISA BOD 26-04?

BOD 26-04, "Prioritizing Security Updates Based on Risk," is a directive CISA issued on June 10, 2026 that tells federal civilian agencies how quickly to fix each vulnerability, based on four questions:

1. Publicly exposed? Can untrusted parties reach the asset over a public network?
2. In the KEV Catalog? Is the CVE on CISA's Known Exploited Vulnerabilities Catalog (opens in a new tab)?
3. Automatable? Can an attacker automate every exploitation step?
4. Technical impact? Does exploitation give total or only partial control?

The answers map to calendar-day deadlines of 3, 14, or 60 days, or "fix on system upgrade" for the lowest-risk combinations. The directive revokes BOD 22-01 and BOD 19-02, and agencies are no longer required to prioritize by CVSS score. CISA publishes the KEV, automatable, and technical impact answers through its Vulnrichment program. Exposure is the one answer each organization supplies about its own assets.

The model is built to shrink the urgent pile. In CISA's initial analysis (opens in a new tab) at one large civilian agency, about 1% of vulnerability instances fell into the three-day category and over 60% were deferred to the next system upgrade.

Why is December 7, 2026 the date that matters?

December 7, 2026 is when BOD 26-04's remediation timelines take full effect for agencies and FedRAMP's new vulnerability rules become mandatory. The directive set three phases: policy updates immediately, process updates within 60 days, and the new remediation timelines within 180 days. FedRAMP's public notice NTC-0014 (opens in a new tab) puts that last phase on December 7.

FedRAMP moved its Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) rules, originally planned to become mandatory in June 2027, to the same date for all cloud service offerings obtaining or maintaining FedRAMP Certification. FedRAMP says the legacy monthly scanning process most Rev5 services follow is insufficient. A grace period runs through March 7, 2027 under a corrective action plan, with notice to all agencies; after that, certification will be revoked for offerings not following the rules.

Does BOD 26-04 apply to contractors and SaaS providers?

Not directly. The directive does not apply to contractors unless the governing procurement contract directs it, but the same sentence tells agencies to review all contracts for needed modifications. The obligations reach vendors in three ways:

• Contracts. Because agencies must review their contracts, remediation timelines may appear in new awards, renewals, and modifications. CISA's implementation guidance (opens in a new tab) strongly recommends putting them in service-level agreements.
• Status reporting. When affected versions turn up at a commercial provider hosting federal assets, the guidance says the provider must report outstanding vulnerability status to the agency, which handles any reporting the directive requires.
• Certification. For FedRAMP cloud services, the VDR and VER rules carry the requirement; FedRAMP says following them meets or exceeds BOD 26-04's expectations.

Organizations with no federal customers are not bound either, but CISA encourages all organizations (opens in a new tab) to adopt risk-based vulnerability management and prioritize KEV remediation, so the decision model is worth borrowing.

What does "3 days and forensic triage" mean?

"3 days and forensic triage" is the strictest outcome in BOD 26-04: remediate or mitigate within three calendar days and check whether the asset was already compromised. It applies when a KEV gives total control and the asset is publicly exposed, or when it gives total control, is automatable, and sits on an internal system.

The forensic part reflects how attackers work. On October 13, 2026, CISA warned (opens in a new tab) that Ivanti's Integrity Checker Tool may not detect exploitation of CVE-2026-104935 in Ivanti Connect Secure because attacker commands run in memory. A patch closes the door. It does not tell you who walked through it first.

CISA's guidance lays out six triage steps with recommended target times: scope within two hours of the KEV addition, preserve evidence and patch within 24 hours, contain, analyze, and reach an escalation decision within 48 to 72 hours. The firm requirement is that an adequate triage happens.

This is common. By our count of CISA's KEV data feed, 89 of the 137 entries added from June 11 through October 20, 2026 were flagged for forensic triage.

What should you have ready by December 7?

An exposure inventory you can defend

List every asset that is internet-reachable, including VPNs, remote-support tools, email gateways, file transfer, and admin consoles, and tag it by environment and owner. FedRAMP's VER rules add a conservative default: assume a vulnerability is automatable unless you have evidence it is not. A security assessment can build that exposure view and rank what to fix first.

A written policy that matches the table

Write the BOD 26-04 decision table into your vulnerability management policy, name who watches KEV additions daily, and define who approves exceptions. CISA does not grant waivers for directive actions. If a fix cannot land in time, its guidance is to remove or isolate the asset.

A rehearsed forensic triage handoff

Decide in advance who collects memory and logs before an edge device is patched or rebuilt, which team or outside firm performs the forensics, and who makes the escalation call. Exercise that handoff with a tabletop. That planning is core incident readiness work, and it overlaps with preparing for ransomware.

Evidence your customers can read

Agencies and prime contractors may ask how you meet these timelines, often through a security questionnaire. Map each requirement to an owner and a record: KEV tracking, remediation dates, triage reports, and exception decisions. Connecting obligations to owners and evidence is what compliance readiness work covers.

Is the KEV Catalog the only list that matters?

No. CISA says many vulnerabilities never get a CVE ID, including unique web application flaws and exploitable identity and authentication configurations, and that they still need fixing. CISA also says it does not see attackers primarily compromising core networks through product vulnerabilities; instead, they often use valid credentials and exploitable configurations. Penetration testing of your applications and APIs can find issues no catalog lists. A test reports what it found within the agreed scope and does not guarantee that other weaknesses are absent, so keep both in the program.

Questions to answer before December 7

1. Which federal contracts and FedRAMP commitments apply to us, and who owns each?
2. Can we produce a current list of internet-facing assets with owners in under an hour?
3. Who checks the KEV Catalog daily, and who owns a three-day fix?
4. Can we capture evidence from an edge device before patching it, and who performs the forensics?
5. What will we tell an agency that asks for remediation status this week?

If several answers are unclear, start a conversation before the deadline.

References

• CISA, BOD 26-04: Prioritizing Security Updates Based on Risk (opens in a new tab) (June 10, 2026)
• CISA, BOD 26-04: Implementation Guidance (opens in a new tab) (updated August 25, 2026)
• CISA, Patch Smarter, Not Harder (opens in a new tab) (June 10, 2026)
• FedRAMP, NTC-0014: FedRAMP Response to CISA BOD 26-04 (opens in a new tab) (June 16, 2026)
• CISA, Known Exploited Vulnerabilities Catalog (opens in a new tab) and JSON data feed (opens in a new tab) (version 2026.10.20)
• CISA, CISA Adds Two Known Exploited Vulnerabilities to Catalog (opens in a new tab) (October 13, 2026)
• CISA, CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure (opens in a new tab) (October 13, 2026)