Common Questions

What is CISA Binding Operational Directive 22-01?

BOD 22-01 is the CISA directive that created the Known Exploited Vulnerabilities catalogue in 2021, compelling US federal civilian agencies to patch listed vulnerabilities within CISA-set deadlines, typically two weeks.Source: CISA

Does the CISA KEV catalogue apply to private companies?

BOD 22-01 only mandates compliance from US federal civilian executive branch agencies. However, the KEV list is widely used by the private sector, insurers, and procurement teams as a minimum patching benchmark.

Why is CISA setting patch deadlines before Microsoft releases a fix?

CISA has issued two federal deadlines in May 2026 before patches existed: a three-day Deadline for Cisco SD-WAN (CVE-2026-20182) and a 29 May Deadline for Exchange CVE-2026-42897 with no Microsoft patch available. BOD 22-01 does not define mitigation as a compliant substitute for patching.Source: CISA

Background

Binding Operational Directive 22-01 (BOD 22-01) was the CISA instrument that created the Known Exploited Vulnerabilities (KEV) catalogue in November 2021, requiring all US federal civilian executive branch agencies to remediate listed vulnerabilities within fixed deadlines (typically 14 days, compressible to 3 days for Emergency Directives). On 10 June 2026 CISA revoked BOD 22-01 entirely and replaced it with BOD 26-04, a risk-tiered model that abandoned the uniform-Deadline architecture. BOD 26-04 assigns one of four windows (3-day, 14-day, 60-day, or next-upgrade-cycle) based on four risk dimensions: exploitation status, CVSS severity, asset criticality, and patch availability. The revocation created transitional ambiguity for in-flight deadlines, including Arista's 23 June window set under the old order.

The replacement was driven by accumulated failure modes the original directive could not absorb. BOD 22-01 had been drafted on the structural assumption that a patch or documented workaround would exist before CISA set a Deadline. That assumption fractured on two fault lines in spring 2026: the Deadline-before-patch pattern (Emergency Directive ED 26-03 set a three-day Cisco SD-WAN window before Cisco had a patch; Exchange CVE-2026-42897 had a 29 May federal Deadline but the fix only arrived 9 June, sixteen days late) ; and vendor refusal (Arista formally declined to ship a software fix for CVE-2026-7473, the first on-record KEV entry where a named vendor explicitly refused to patch).

BOD 22-01 remains significant as a historical baseline: its fixed-Deadline model ran for nearly five years and produced the KEV catalogue that is now a de facto industry patch benchmark extending well beyond its federal scope. Private-sector insurers, procurement teams, and security auditors continue to treat KEV listings as the minimum mandatory-patch universe regardless of the directive model change. BOD 26-04 inherits the catalogue but replaces the compliance mechanics; the patch-obligation logic that made BOD 22-01 the most operationally influential US federal cybersecurity directive since FISMA is now formally retired.