BOD 22-01

Binding Operational Directive 22-01 (BOD 22-01) is the CISA instrument that created the Known Exploited Vulnerabilities (KEV) catalogue in November 2021, requiring all US federal civilian executive branch agencies to remediate listed vulnerabilities within CISA-set deadlines, typically two weeks but compressible to three days for critical active-exploitation events. The directive has no statutory force against private-sector organisations, though the KEV catalogue functions as a de facto industry benchmark: insurers, procurement teams, and security auditors treat KEV-listed CVEs as the minimum mandatory-patch universe.

BOD 22-01 was drafted on the structural assumption that a patch or documented workaround would exist before CISA set a deadline. That assumption has frayed in 2026. CISA issued Emergency Directive ED 26-03 on 14 May 2026 for Cisco SD-WAN CVE-2026-20182 (CVSS 10.0) with a three-day remediation window before Cisco had confirmed a patch timeline. On 15 May 2026 CISA added Exchange Server CVE-2026-42897 with a 29 May deadline while Microsoft's only available step was the Exchange Emergency Mitigation Service workaround, not a full patch. That was the second deadline-before-patch in twelve days, establishing the pattern as posture rather than exception.

The practical tension is constitutional to the directive's text: BOD 22-01 requires "remediation" but does not define mitigation as a compliant substitute. Federal CISOs facing an unpatchable KEV deadline must document a workaround response that the directive does not explicitly sanction, and that gap has now accumulated two public worked examples inside a single reporting window.