From Directive to Deadline: Operating BOD 26-04

Watch the on-demand webinar with Bob Costello, former CIO of CISA, and Scott Kuffer, Co-founder and CPO of Nucleus Security

BOD 26-04 is one of the fastest and biggest changes to federal cybersecurity policy in years. It replaces severity-based, 30-day patching with a risk-based approach that asks a few questions about each vulnerability:

• Is the asset exposed to the internet?
• Is the vulnerability being exploited?
• Can the exploit be automated?
• What is the real impact in your environment?

Federal civilian agencies must meet the new timelines by December 7, 2026, and FedRAMP environments come under the directive’s watch on the same date. Organizations have little time to turn the policy into a working process.

In this webinar, Bob Costello and Scott Kuffer cover what the directive requires, why CISA designed it this way, and how teams can put it into practice. Bob helped shape the directive while at CISA and now runs FedRAMP environments in the private sector, so he has seen it from both sides.

What You’ll Learn About CISA BOD 26-04

• Why CISA moved from severity scores to a risk-based model, and what changes for your team
• How the SSVC decision-tree framework works, and why it’s easier to explain than a numeric score
• What December 7 means for federal agencies and FedRAMP providers, and what happens if you miss it
• Practical ways to handle the forensic triage requirement without overwhelming your team
• Where CVSS scores still help, and where they mislead
• How to automate BOD 26-04 prioritization, reporting, and tracking instead of managing it in spreadsheets
• How AI is changing both vulnerability management and the threats behind it

Why the Old Model Stopped Working

For years, defenders have had more vulnerabilities than they could patch or test. Bob says that made vulnerability management “a no-win scenario.” Severity scores alone didn’t help much. Two systems can have the same CVE with the same severity rating, but if one is exposed to the internet and the other isn’t, the risk is very different. Thirty days is also too long to leave an exposed, actively exploited vulnerability open, especially as AI speeds up how quickly attackers can find and chain together weaknesses.

BOD 26-04 addresses this with a decision-tree model based on Stakeholder-Specific Vulnerability Categorization (SSVC), developed at Carnegie Mellon’s Software Engineering Institute. The model looks at four factors:

• Asset exposure
• Known exploitation, including the CISA Known Exploited Vulnerabilities (KEV) catalog
• Whether the exploit can be automated
• Technical impact

Every combination of these factors leads to one of four outcome categories, and each category comes with a clear action and deadline. Scott says this makes decisions far easier to defend at the policy level. Teams act because specific conditions are true, not because a score crossed an arbitrary threshold.

Deadlines, Compliance, and the Reality of Enforcement

Bob explains what the December 7 milestone involves:

• Meeting the new remediation timelines
• Continuously identifying and tagging exposed assets
• Meeting new asset reporting requirements

Monthly scans are no longer enough. Continuous visibility is the foundation for both BOD 26-04 and the shift toward ongoing authorization in FedRAMP.

For providers that can’t meet the dates, Bob describes the corrective action plan process. He also explains why CISA’s enforcement relies more on partnership, scorecards, and authorizing officials’ decisions than on a single hammer. For FedRAMP cloud service providers, the business stakes are higher. Agencies still issue an ATO for each solution, and FedRAMP 20x is moving toward real-time reporting on vulnerability and exposure posture.

Tackling Forensics and Rethinking CVSS

Both speakers see forensic triage as one of the heaviest parts of the directive, and the directive doesn’t define it precisely. Their advice:

• Define what forensic triage means for your organization.
• Focus hands-on investigation on the most urgent outcome category.
• Reduce unnecessary internet exposure, so fewer vulnerabilities trigger the requirement in the first place.

On CVSS, Scott separates the score as designed from the score as used. The base score most teams rely on measures technical severity, not risk. Bob adds that a 9.9 can be irrelevant in an environment where the affected service isn’t enabled. Meanwhile, a 3 can be the most important fix once you look at the whole system.

BOD 26-04 in Action

In the second half, Bob plays the role of a practitioner and puts real BOD 26-04 questions to Scott, who answers them in the Nucleus platform. The walkthrough covers:

• Finding your exposure: Identifying internet-facing assets with KEVs, and checking scan coverage so you know whether your data can be trusted
• Automating prioritization: Mapping every new finding to its BOD 26-04 category, due date, and forensic triage status as it comes in
• Reporting: Using an operational readiness dashboard, a forensic triage investigation queue, past-due tracking, and baselines that compare your overall program with your critical external assets
• Enrichment: Adding vulnerability intelligence, threat actor activity, and remediation guidance tied to the assets in your environment
• Investigating new threats: Searching software inventory and recent CVEs to find affected systems quickly, even before a scan runs

Bob also stresses that the approach isn’t limited to government. Policies that begin in the federal space often spread to FedRAMP providers, the defense industrial base, and critical infrastructure. The risk-based model can be applied anywhere software runs.

The AI Factor and What Comes Next

The conversation ends with a look at AI. Scott explains how natural-language interfaces are changing how teams work with vulnerability data. He also notes that as more organizations build their own software, vulnerability management shifts from patching other vendors’ bugs to fixing your own.

Both speakers are most concerned about how fast AI can turn known vulnerabilities into working exploits. Bob warns that capabilities once limited to nation-states are now within reach of well-funded cybercrime groups.

In audience Q&A, Bob notes that BOD 26-04 replaced BOD 19-02 and BOD 22-01, and he doesn’t expect it to be replaced anytime soon. Scott points to a later executive order calling for another directive. That directive will focus on how AI-discovered vulnerabilities are communicated, not on changing the core of BOD 26-04.

About the Speakers

Bob Costello is the former CIO of CISA and spent more than 18 years in cyber and IT leadership roles at the Department of Homeland Security. He is now Chief Digital and Information Officer at The Merlin Group and a strategic advisor to Nucleus Security.

Scott Kuffer is Co-Founder of Nucleus Security, where he leads the product organization. He has a background in federal cybersecurity, including the RMF and ATO processes.