BOD 19-02
Revoked 2019 CISA directive that set 15- and 30-day federal patch deadlines.
In September 2026 CISA gave federal agencies three days to fix 34 of the 43 exploited flaws it listed. BOD 19-02, the revoked 2019 directive, had allowed 15 days for critical flaws and 30 for high ones.
Last refreshed: 12 October 2026
Why did CISA abandon severity-based patch deadlines?
Timeline for BOD 19-02
Named as BOD 19-02
Cybersecurity: Threats and Defences: Mentioned in: CISA set three-day deadlines on 34 flawsBackground
Binding Operational Directive 19-02, issued by CISA on 29 April 2019, told US federal agencies how fast to fix flaws in systems reachable from the public internet. Critical vulnerabilities had to be remediated within 15 calendar days and high-severity ones within 30. It replaced an earlier order, BOD 15-01.
The clock started when CISA's scanning detected a flaw, and the Deadline depended on its severity score, whether or not anyone was exploiting it. That made BOD 19-02 a severity-first rule for internet-facing federal systems.
CISA has since revoked the directive. Its page now names BOD 26-04, Prioritizing Security Updates Based on Risk, as the replacement, and exploitation rather than score drives the shortest federal deadlines.
Exploitation now sets the clock
BOD 19-02 measured urgency by severity score alone. The deadlines that matter now are keyed to exploitation: in September 2026 CISA put 43 flaws on its Known Exploited Vulnerabilities list, and 34 of them, 79 per cent, carried a three-day window. The other nine got 14 days, and the three-day share had been 71 per cent in August.
Under the 2019 directive a critical internet-facing flaw allowed 15 days and a high one 30, counted from CISA's own scanning. Three days leaves federal IT Teams no room for the monthly change window most of them run on. The median stayed at three days under the risk-tiered rules that replaced fixed deadlines in June 2026.