Vulnerability queues have long been ordered by severity. CISA's Binding Operational Directive 26-04 moves Federal Civilian Executive Branch agencies toward a more operational question: what should be fixed first, given the asset's exposure, evidence of exploitation and likely technical impact?
01 · The directive
Risk belongs in context.
Issued on 10 June 2026, BOD 26-04 establishes a risk-based approach to prioritising security updates. It brings together factors that are often scattered across vulnerability scanners, infrastructure inventory, threat-intelligence feeds and remediation workflows.
Public exposure matters. So does inclusion in CISA's Known Exploited Vulnerabilities catalogue, whether exploitation can be automated, and the technical consequence of a successful exploit. The value is not another score; it is a defensible path from evidence to required action.
02 · Beyond severity
A critical CVSS score is a signal, not a decision.
CVSS describes technical severity. EPSS estimates the probability of exploitation. KEV records exploitation observed in the wild. None of these alone explains the operational priority of a finding in its environment.
The decision changes when vulnerability intelligence is connected to the asset that carries the risk.
An internet-exposed workload with an automatable, known-exploited vulnerability presents a different decision from the same CVE in a non-public development asset. Statepoint is designed to preserve that relationship instead of reducing it to an isolated row in a scanner.
03 · The evidence chain
Connect the finding to the environment.
Statepoint connects infrastructure scope, asset and workload identity, network exposure, image digest, package version, CVE, CVSS, EPSS, KEV status, affectedness, fixed version and observation time. That gives teams a traceable record of both the vulnerability and the environment in which the decision was made.
04 · Decision record
Make the reasoning visible.
A BOD-oriented decision record should show the inputs, the resulting priority, the required remediation date and a plain-language explanation of how the outcome was reached.
Priority is derived from the recorded exposure, KEV status, automatable exploitation and technical-impact assessment. The explanation remains attached to the evidence used at decision time.
This turns remediation from a point-in-time ranking exercise into an accountable workflow: teams can see what was known, why the item was prioritised and whether action occurred within the applicable period.
05 · Accountability
Technology supports the obligation; it does not replace it.
Statepoint can support implementation through connected evidence, consistent prioritisation and remediation traceability. Agencies remain responsible for governance, scope, operational response and meeting every applicable requirement of the directive.
BOD 26-04 applies to Federal Civilian Executive Branch agencies. Statepoint supports implementation and evidence workflows; each agency remains responsible for meeting the directive's applicable requirements.
Sources
CISA · BOD 26-04: Prioritizing Security Updates Based on Risk CISA · Known Exploited Vulnerabilities Catalog