CISA BOD 22-01 Known Exploited Vulnerabilities — November 3, 2021
CISA’s Binding Operational Directive 22-01 established a mandatory catalog of known exploited vulnerabilities with remediation deadlines, compelling agencies and contractors to prioritise patching, validation, and reporting.
Executive summary. On 3 November 2021, the Cybersecurity and Infrastructure Security Agency (CISA) issued Binding Operational Directive (BOD) 22-01, requiring US federal civilian agencies to remediate vulnerabilities listed in the Known Exploited Vulnerabilities (KEV) Catalog within aggressive deadlines and to establish ongoing processes for monitoring, reporting, and prioritising remediation efforts.[1] Although aimed at federal agencies, the directive has become a de facto benchmark for private-sector patch management programmes.
Directive scope. BOD 22-01 mandates that agencies address KEV entries within two weeks for newly added vulnerabilities (or by the due dates specified in the catalog) and within six months for historical vulnerabilities initially catalogued at issuance.[2] Agencies must also establish processes for identifying and tracking KEVs, reporting compliance status, and updating asset inventories.
KEV Catalog mechanics. CISA maintains the KEV Catalog as a living dataset, adding vulnerabilities that are actively exploited and pose significant risk to federal networks. Each entry includes CVE identifiers, affected products, and remediation due dates.[3] Updates are announced via CISA alerts and RSS feeds.
Concrete compliance controls.
- Automated catalog ingestion. Integrate KEV feeds into vulnerability management platforms (Tenable, Qualys, Rapid7) and SIEM systems to automatically tag vulnerabilities requiring expedited remediation.
- Asset criticality mapping. Maintain an inventory linking assets to mission/business functions, enabling prioritisation when KEVs affect high-value systems.
- Patch orchestration. Implement change-management workflows that allow emergency patch windows, including pre-approved maintenance periods and rollback plans.
- Exception management. Establish a formal process for documenting and approving temporary mitigations when immediate patching is infeasible, including compensating controls and timelines.
- Validation and reporting. Use configuration management databases (CMDBs) and vulnerability scanners to verify remediation, generating dashboards for CISO and CIO oversight.
Implementation roadmap.
- Week 1: Align stakeholders (security operations, infrastructure, application owners) on KEV processes, designate leads, and integrate KEV feed ingestion.
- Week 2: Update patch playbooks to reflect BOD deadlines, implement automated notifications, and run initial compliance scans.
- Week 3: Conduct tabletop exercises simulating KEV additions, including emergency patch deployment and reporting to CISA/OMB.
- Week 4: Finalise metrics dashboards, document exception workflows, and review contractual implications for suppliers.
- Ongoing: Monitor KEV updates at least weekly, reconcile remediation status, and brief leadership on outstanding risks.
Reporting obligations. Agencies must submit initial remediation status to CISA within 60 days of the directive and provide ongoing updates. Reports must detail completed remediations, pending actions, and justifications for any delays.[2]
Supplier and contractor expectations. Federal contractors increasingly adopt KEV-based SLAs to align with agency requirements. Contracts may require evidence of KEV monitoring, remediation timelines, and incident response coordination.
Integration with risk frameworks. Map KEV remediation controls to NIST SP 800-53 (SI-2, RA-5), NIST SP 800-40, and the Continuous Diagnostics and Mitigation (CDM) programme to streamline audits.
Metrics and monitoring. Track KEV remediation status (% closed, % with approved exceptions), mean time to remediate KEVs, number of assets exposed per CVE, and time to detect new KEV entries in tooling. Visualise metrics in executive dashboards.
Change management. Coordinate KEV-driven patches with change advisory boards while acknowledging that BOD deadlines may necessitate emergency change pathways. Document risk acceptance for any delays and obtain senior approval.
Incident response linkage. Update incident response plans to reference KEV catalog entries. If exploitation is detected, ensure forensic teams gather evidence, report to CISA, and coordinate with law enforcement as required.
Continuous improvement. Conduct quarterly retrospectives analysing KEV remediation performance, root causes of delays, and automation opportunities. Implement lessons learned into patch pipelines.
Technology enablers. Leverage configuration management tools (Ansible, SCCM) and endpoint management solutions to deploy patches rapidly. Use application allowlisting or virtual patching when vendor fixes are unavailable.
Communications. Establish notification workflows to alert system owners, leadership, and, where applicable, customers about KEV-related remediation actions. Provide status updates until remediation is complete.
Risk prioritisation beyond KEV. Augment KEV-driven remediation with exploitability metrics (EPSS), threat intelligence, and business impact to ensure resources focus on the highest risks.
Future outlook. CISA periodically updates BOD 22-01 guidance, including clarifications on reporting and catalog management. Agencies should anticipate evolving deadlines, expanded asset coverage (operational technology), and integration with zero-trust initiatives.
Risks of non-compliance. Failure to remediate KEVs can lead to exploitation, operational disruption, and potential oversight actions from CISA and OMB. Demonstrating disciplined processes, documentation, and executive engagement mitigates these risks.
Asset discovery. BOD 22-01 emphasises accurate asset inventories; implement continuous discovery using network scanning, agent-based tools, and cloud APIs to ensure KEV exposure is understood.
Vulnerability intelligence. Combine KEV data with vendor advisories, threat intelligence feeds, and mitigation guidance to prioritise patches when release schedules conflict.
Operational technology. For OT and industrial control systems, coordinate with vendors to deploy patches safely, leveraging maintenance windows and monitoring for unintended consequences.
Third-party oversight. Require managed service providers and software vendors to attest to KEV remediation timelines and provide reporting, ensuring supply-chain dependencies do not reintroduce risk.
Documentation. Maintain evidence packages—including scan reports, ticketing records, change approvals, and exception memos—to demonstrate compliance during CISA or Inspector General audits.
Training. Educate system owners and developers on KEV expectations, including how to interpret catalog entries and the importance of timely patch validation.
Automation. Implement scripts or orchestration workflows that automatically create remediation tickets when new KEVs are published, assign ownership, and track completion against deadlines.
Metrics deep dive. Segment metrics by business unit and technology stack to identify chronic backlogs or systemic issues (e.g., unsupported operating systems) that impede compliance.
Continuous monitoring. Integrate KEV compliance status into security scorecards and risk registers used in enterprise governance, risk, and compliance platforms.
Lessons learned. After each major KEV campaign, document lessons, refine playbooks, and update automation scripts to reduce future remediation cycle times.
Post-remediation verification. Perform targeted penetration testing or attack simulations after closing high-severity KEVs to validate that compensating controls and patches effectively block exploitation pathways.
Governance cadence. Schedule monthly KEV review meetings with executive sponsors to sustain urgency and unblock resource constraints.
Stakeholder alignment. Include enterprise risk management, legal, and communications teams in KEV briefings so remediation status informs disclosures and investor reporting.
Continue in the Cybersecurity pillar
Return to the hub for curated research and deep-dive guides.
Latest guides
-
Cybersecurity Operations Playbook — Zeph Tech
Use Zeph Tech research to align NIST CSF 2.0, CISA KEV deadlines, and sector mandates across threat intelligence, exposure management, and incident response teams.