CriticalAPT
The Race Against the 3-Day Clock: How Rapid7 Helps Meet BOD 26-04 Compliance
Rapid7·Source published ·1 min read
What happened?
Introduction to BOD 26-04 On June 10, 2026, CISA issued Binding Operational Directive 26-04, "Prioritizing Security Updates Based on Risk." Strip away the regulatory language and it reads like a single operational fact: for a vulnerability that is actively exploited, publicly reachable, and grants an attacker full control, you now have three calendar days to remediate it — and you must run a forensic investigation in parallel to determine whether you've already been breached.