CISA's BOD 26-04 sets a 3-day patch clock for KEV on internet-exposed federal systems. FedRAMP is already aligned. Analysts expect CMMC, NIS2, and DORA to follow. Insurers are folding the same logic into questionnaires. It's formally a federal directive; functionally it's becoming an industry baseline. https://www.cybrsecmedia.com/federal-agency-or-not-how-bod-26-04-is-coming-for-your-vulnerability-management-program/
#infosec #vulnerabilitymanagement #patchmanagement #CISA