Skip to content
You can now search across every topic, entity and event.What's new
Binding Operational Directive
ConceptUS

Binding Operational Directive

A compulsory CISA directive setting mandatory security actions and deadlines for US federal civilian agencies.

A Binding Operational Directive is CISA's compulsory tool for setting security deadlines on US federal agencies; BOD 26-04, its current version, took effect 10 June 2026 and enters Phase II around 9 August.

Last refreshed: 3 August 2026 · Appears in 1 active topic

Key Question

The BOD 26-04 clock only starts when CISA catalogues a flaw, so what happens when detection runs a month ahead?

Timeline for Binding Operational Directive

#13 2 Sept

Mentioned in: KEV three-day deadline share fell to 65%

Cybersecurity: Threats and Defences
#11 16 Jul

CISA's KEV list runs a month late

Cybersecurity: Threats and Defences
#12 9 Jun

Mentioned in: Phase II asks agencies for paperwork

Cybersecurity: Threats and Defences
View full timeline →
Follow Cybersecurity: Threats and Defences →

Background

A Binding Operational Directive is a compulsory instrument the Cybersecurity and Infrastructure Security Agency uses to set mandatory security actions and deadlines for US federal civilian executive branch agencies. Directives are numbered sequentially and superseded as CISA revises its approach; BOD 22-01 and BOD 26-04 are successive examples covering vulnerability remediation.

The instrument binds only federal agencies directly; private-sector organisations are not compelled to follow the same deadlines, though many use CISA's directives as an informal benchmark for their own patching priorities.

Directives of this kind differ from legislation in that they do not require congressional action to take effect or be revised; CISA issues and updates them administratively, which lets the mandated deadlines shift relatively quickly as the agency's risk assessment changes.

Key Issues
Directive phasing

The current directive enters Phase II

Binding Operational Directives are the mechanism CISA uses to compel federal civilian agencies to take specific security actions by a set Deadline; the current one, BOD 26-04, replaced a flat 14-day default with risk-tiered windows on 10 June 2026. Its Phase II falls due around 9 August, sixty days after issuance, and requires agencies to update internal vulnerability-management procedures and hand copies to CISA on request.

That phase carries no public filing requirement and no way for CISA to name an agency that falls short. A month earlier, the tool's tightened deadlines had already been blamed for a case where CISA's own KEV catalogue lagged active exploitation of a FortiSandbox flaw by a month.

Common Questions
What is a Binding Operational Directive?
A Binding Operational Directive is a compulsory instruction from CISA setting mandatory security actions and deadlines for US federal civilian executive-branch agencies.Source: CISA
When does CISA's BOD 26-04 patching deadline start?
The BOD 26-04 clock starts when CISA adds a flaw to its Known Exploited Vulnerabilities catalogue, which in the FortiSandbox case ran a month behind private detection by CrowdSec.Source: CISA
Does a Binding Operational Directive apply to private companies?
No. Binding Operational Directives bind only US federal civilian executive branch agencies. Private-sector organisations aren't compelled to follow the same deadlines, though many track CISA's directives as an informal patching benchmark.Source: CISA
What is the difference between BOD 22-01 and BOD 26-04?
BOD 22-01 set fixed remediation deadlines for every KEV-catalogued flaw. BOD 26-04, issued 10 June 2026, replaced that with a four-tier risk model assigning three, 14 or 60-day windows, or next-upgrade-cycle timing, depending on severity, and revoked the fixed-Deadline regime that preceded it.Source: CISA