The Race Against the 3-Day Clock: How Rapid7 Helps Meet BOD 26-04 Compliance

On June 10, 2026 CISA issued Binding Operational Directive 26-04, which mandates a three-day remediation window for any vulnerability that is actively exploited, publicly reachable, and grants an attacker full control, plus a concurrent forensic investigation. The directive replaces BOD 19-02 and BOD 22-01, shifting from static CVSS scores and a blanket 14-day deadline to a dynamic model based on four binary variables from the SSVC framework: Asset Exposure, KEV Status, Exploit Automation, and Technical Impact. Rapid7 maps these variables to its capabilities, noting that half of Q1 2026 exploited flaws were zero-click, network-facing issues and two-thirds required no user interaction. CISA’s tiered timelines range from 3 days for critical, KEV-listed, total-control bugs to 60 days for standard, internal, partial-control cases, and it counts isolation or mitigation as valid remediation. ¹