CISA issues BOD 26-04, replacing KEV remediation rules with risk-based timelines for federal civilian agencies
Federal civilian agency security teams must migrate from the prior KEV remediation regime to BOD 26-04's risk-based timelines, with policy updates due immediately and remediation timelines enforceable within 180 days