CISA's Binding Operational Directives: the security rules US federal agencies have to follow. You don't. Do it anyway.
Wait, what's a BOD?
A Binding Operational Directive is CISA telling federal civilian agencies, in writing, "fix this, by this date, and no, that's not a suggestion." Think of them as CISA's greatest hits of "we keep watching people get owned by the exact same thing."
They're written for agencies, but the advice works for anyone with a network, a budget, and a pulse. If the federal government can do it, with its procurement process, so can you.
When something is actively on fire, CISA skips the essay and issues an Emergency Directive instead (recent ones: F5 and Cisco gear, naturally). BODs are the long game.
The TL;DR, for people who don't read (hi)
Patch by risk: internet-exposed + exploited = days, not "next quarter" (26-04)
Throw out end-of-support edge devices. Yes, that one. (26-02)
Fix your cloud config. The defaults are not your friend. (25-01)
Get admin panels off the internet. Seriously. (23-02)
Know what you own and scan it constantly. Spreadsheets don't count. (23-01)
Let people report your bugs without calling your lawyers (20-01)
Protect the crown jewels first. Not "everything," the jewels. (18-02)
DMARC, HTTPS, no ancient crypto. It's 2026. (18-01)
"Two weeks" is out. "Three days" is in. What's your excuse again?
What it means
Stop patching by CVSS score and vibes. Ask four questions about every vuln: Is it on the internet? Is it on KEV? Can attackers automate it? Do they get the whole box or just part of it? Enough "yes" answers and you have 3 days. The worst ones also mean checking whether you've already been owned. To answer any of this, you need to know which of your assets are internet-reachable, so tag them: exposure, environment, type. Cue nervous laughter.
BOD 26-04 Table 1: remediation timelines (calendar days)
Internet-exposed?
On KEV?
Automatable?
Control gained
Deadline
Yes
Yes
Yes
Total
3 days + forensic triage
Yes
Yes
Yes
Partial
3 days
Yes
Yes
No
Total
3 days + forensic triage
Yes
Yes
No
Partial
14 days
Yes
No
Yes
Total
3 days
Yes
No
Yes
Partial
14 days
Yes
No
No
Total
14 days
Yes
No
No
Partial
60 days
No
Yes
Yes
Total
3 days + forensic triage
No
Yes
Yes
Partial
14 days
No
Yes
No
Total
14 days
No
Yes
No
Partial
14 days
No
No
Yes
Total
60 days
No
No
Yes
Partial
60 days
No
No
No
Total
Fix on next upgrade
No
No
No
Partial
Fix on next upgrade
Source: BOD 26-04, Table 1. "Forensic triage" means figuring out whether you were already owned. Also within 3 days. No pressure.
What you should do (yes, you)
Answer the four questions. CISA already publishes three of the answers for every CVE (Vulnrichment). The fourth is "is it on the internet," and if you don't know that, we've found your real problem.
Internet-facing + KEV + automatable = 3 days. Not "next sprint." Not "after the freeze." Three. Calendar. Days.
If the bug gives total control, "we patched it" is half the job. The other half is "and nobody was already living in it."
An unsupported firewall is just a very expensive welcome mat.
What it means
If your firewall, VPN, or router stopped getting security updates, it's a liability with blinking lights. Update anything still supported right now. Inventory every edge device and its end-of-support date. Replace the dead ones (within months, not years), and keep discovery running so you never end up here again. You will end up here again.
What you should do (yes, you)
Make a list of every edge device and its end-of-support date. Yes, including the one in the closet that "just works."
If the vendor stopped patching it, replace it. "It still turns on" is not a support contract.
Put EOS dates in the budget before they arrive, not in the incident report after.
"It's in the cloud" means it's on someone else's computer, configured by you. Badly.
What it means
"We moved to the cloud" didn't automatically make anything secure. Who knew. Inventory every cloud tenant you have, run CISA's free SCuBA assessment tools against them, and turn on the secure configuration baselines, starting with Microsoft 365, where every default setting is a choose-your-own-adventure.
What you should do (yes, you)
Run CISA's free ScubaGear against your Microsoft 365 tenant. It will hurt your feelings. That's the point.
Fix the mandatory stuff first: MFA everywhere, legacy auth dead, fewer global admins than you have fingers.
Re-run it on a schedule. Config drift is real, and someone always clicks "Allow" on a Friday.
If your firewall's login page is on the internet, it's not a firewall, it's a lobby.
What it means
Don't put the admin login page on the internet. Someone had to write a whole directive to say that. Let it sink in. Routers, switches, firewalls, VPN concentrators, proxies, load balancers, iLO, iDRAC: the moment you find an exposed management interface, yank it onto an internal (ideally isolated) management network or put it behind a Zero Trust gateway. You've got about two weeks, tops.
What you should do (yes, you)
Scan yourself from the outside. Shodan already did, and so did people with worse intentions than Shodan.
Admin panels live on a management network or behind a Zero Trust gateway. Never on 0.0.0.0. Never.
Check every new device on day one. Vendors ship defaults like they're paid by the open port.
You can't patch what you don't know you have. And you have way more than you think.
What it means
Know what you own and what's wrong with it. Run automated asset discovery every week, kick off vulnerability scans on everything you find (yes, the laptops too) every two weeks, and use credentialed scans wherever you can. Stop guessing.
What you should do (yes, you)
Automated asset discovery, weekly. "Dave's spreadsheet" is not asset discovery, and Dave left in 2022.
Credentialed vuln scans every two weeks, including laptops that only connect from coffee shops.
When a scan finds something nobody claims, that's not a scanner bug. That's a finding. Congrats.
Someone is going to find your bug. Make it easy for the nice ones to tell you first.
What it means
Make it easy for strangers to tell you you're broken. Have a monitored security contact for every domain, publish a disclosure policy that says what's in scope and promises not to sue good-faith researchers, and have an actual process for handling reports instead of letting them rot in a shared inbox.
What you should do (yes, you)
Publish a security.txt and a short disclosure policy. It's a text file. You can do a text file.
Monitor the inbox. A researcher emailing you a bug is a free pentest. Say thank you.
Don't threaten people who report bugs. That's how your bugs end up on a forum with a logo and a theme song.
Your crown jewels deserve better than "we'll get to it."
What it means
Figure out your High Value Assets, the systems that would end careers if they got popped. Get them assessed, and fix the major and critical weaknesses on a deadline, not "eventually." This is the second directive on the topic, because the first try evidently needed a sequel.
What you should do (yes, you)
Write down your crown jewels. If your list says "everything," you don't have a list, you have anxiety.
Get them assessed, then actually fix the findings. Re-discovering the same finding every year is not a tradition.
When everything's on fire, these get patched first. Everything will be on fire.
If it's 2026 and your DMARC is still p=none, you're running an open spoofing service.
What it means
Lock down email and web basics. Turn on STARTTLS, publish SPF and DMARC (and work your way to p=reject), kill SSLv2, SSLv3, 3DES, and RC4, and move every public site to HTTPS with HSTS. This has been the standard since 2017, so you're not early.
What you should do (yes, you)
SPF and DMARC on every domain, marching toward p=reject. Yes, the parked domains too. Especially the parked domains.
HTTPS everywhere, HSTS on, ancient protocols and ciphers off. RC4 is old enough to drive.
This is an afternoon of work that stops strangers from sending phishing emails as you. Do the afternoon.
The thing with kernel access should probably be on your side.
What it means
Be picky about who gets god-mode on your systems. This one was about pulling Kaspersky products over concerns about Russian government influence, but the real lesson is bigger: the software with the most access to your systems should be the software you trust the most.
What you should do (yes, you)
Know which vendors run with god-mode privileges in your environment: AV, EDR, RMM, "lightweight" agents.
Have a plan to rip one out fast. If the plan is "pray," that's not a plan.
Your security software has the keys to everything. Pick it like it does.
Routers get owned too. They just don't complain about it.
What it means
Attackers have been caught modifying network device firmware. Harden your routers and switches, and verify their software hasn't been quietly swapped for something with extra features. The bad kind of features.
What you should do (yes, you)
Treat network gear like servers: patch it, harden it, log it. Routers have feelings too (vulnerabilities).
Verify firmware images against vendor hashes. Trust, but checksum.
Lock down who and what can manage network devices. "Everyone on the VLAN" is not an access policy.
Boring, but "we didn't know we had to report that" is a terrible headline.
What it means
The paperwork one: know your reporting obligations and track your security metrics. Nobody's making a movie about this, but somebody has to fill out the forms, and "we didn't know" is not a defense.
What you should do (yes, you)
Know who you have to notify about an incident (regulators, customers, insurers, lawyers) before you have one.
Gave us the KEV catalog and the "patch KEVs by the due date" rule. Revoked by BOD 26-04 in June 2026. The catalog survived; the generous deadlines didn't. Press F.
Criticals on internet-facing systems in 15 days, highs in 30. Revoked by BOD 26-04. Fifteen days now sounds like a sabbatical.
BOD 16-01RevokedSecuring High Value Assets
Replaced by BOD 18-02 because the first attempt at "protect your most important stuff" needed a reboot. Fitting.
BOD 15-01RevokedCritical Vulnerability Mitigation Requirement
The OG: patch critical internet-facing vulns within 30 days. Thirty. Days. A simpler, more innocent time.
Plain-English (and slightly unhinged) summaries. Informational only, not official guidance. Read the actual directive, linked on each title, before you bet your job on our jokes. Status per cisa.gov/directives as of October 2026.