# CISA Requires Agencies Prioritize Remediation

CISA’s Binding Operational Directive 26-04, issued June 10, 2026, requires covered civilian federal agencies to prioritize software vulnerability remediation according to risk, with remediation due within three days for the highest-risk tier. Federal contractors and critical-infrastructure suppliers are not directly subject to the directive, but agencies may set similar expectations through contracts and security programs. Procurement teams and contractors should assess whether their tools and processes can track exposure continuously and produce auditable evidence that remediation deadlines are met.

- Agencies must align vulnerability remediation with CISA’s risk tiers; the highest-risk vulnerabilities carry a three-day remediation deadline.
- Contractors should review applicable contract and security-program terms to determine whether comparable remediation timelines or evidence requirements apply to their work.
- Organizations supporting federal agencies can evaluate whether their vulnerability-management processes provide continuous exposure tracking and auditable remediation records.

**Jurisdictions:** federal
**Industries:** Information Technology
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** November 12, 2026

### Government Entities
- Cybersecurity and Infrastructure Security Agency (CISA)

### Vendors
- RapidFort ()

### Key Quotes
> The challenge is what agency leaders can do now that this directive exists, especially given that the AI risk-generation machine keeps increasing the number of risks and shortening the time to act,
> — Berk Bucukoglu, Public-Sector VP, RapidFort

> Teams are now expected to prove that remediation is happening on time against a risk-weighted CISA standard, not just show that scans were run and tickets were filed,
> — Austin Sedaghatpour, National Security Leader, RapidFort

### Sources
- [Complying with CISA: How continuous analysis aligns with BOD 26-04 | resource | SC Media](https://www.scworld.com/resource/complying-with-cisa-how-continuous-analysis-aligns-with-bod-26-04) - SC Media