CISA Sets 72-Hour Patch Window for Federal Systems Facing Highest Cyber Risks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has introduced a new risk-based approach to vulnerability remediation, requiring federal civilian agencies to patch the most dangerous cyber vulnerabilities within 72 hours. Announced through Binding Operational Directive (BOD) 26-04, the new CISA vulnerability management directive replaces older remediation requirements with a framework designed to prioritize vulnerabilities that pose the greatest risk to government systems.

The move comes as cybersecurity officials warn that while ensuring agencies focus resources on threats most likely to be exploited.

New Risk-Based Model for Vulnerability Remediation

Under the directive, federal civilian agencies must evaluate vulnerabilities against

Inclusion in CISA's meeting three of these four conditions will face accelerated remediation deadlines.

The strictest requirement applies to vulnerabilities that are actively exploited, can be automated, and affect internet-facing systems. Agencies must patch such vulnerabilities within 72 hours.

In cases where exploitation could allow attackers to gain complete control of a system, agencies are also required to investigate whether a compromise has already occurred before applying management directive is the growing concern that artificial intelligence is reducing the time between the release of a security patch and active exploitation by threat actors.

CISA noted that cybercriminals are increasingly leveraging mandates:

• BOD 19-02, which focused on vulnerability remediation for internet-accessible systems


• BOD 22-01, which addressed the directive is intended to help agencies focus on areas of highest risk while improving transparency, predictability, and resource planning for remediation efforts.
  
  The agency also encouraged organizations outside the federal government to adopt similar risk-based emphasized that installing a security update does not automatically remove attackers who may already have gained access to a network.
  
  As a result, agencies must assess when and how a compromise occurred and conduct appropriate investigations before remediation. This requirement reflects growing concerns that attackers often maintain persistence inside networks even after vulnerabilities are patched.
  
  The agency described compromise assessment as a critical component of effective cybersecurity risk management, particularly for vulnerabilities already known to be exploited in the wild.
  

  Strengthening Federal Cybersecurity Readiness

  
  The CISA vulnerability management directive aligns with broader U.S. government efforts to strengthen cybersecurity and secure federal information systems against increasingly sophisticated threats.
  
  The directive supports objectives outlined in the Executive Order on Promoting Advanced Artificial Intelligence Innovation and Security, which calls for enhanced protection of civilian federal networks.
  
  As agencies implement the new requirements, CISA will monitor compliance, track progress, and provide support where necessary. The agency said the initiative represents an important step toward reducing cybersecurity risk across the federal enterprise while ensuring faster responses to the vulnerabilities most likely to be targeted by attackers.
  Vollständiges Original-Advisory

  Ausführliche Details, Exploit-Analyse & Hersteller-Stellungnahme auf thecyberexpress.com.

  ↗ Original-Artikel auf thecyberexpress.com lesen