The Race Against the 3-Day Clock: How Rapid7 Helps Meet BOD 26-04 Compliance
Rapid7, Wednesday, November 4th, 2026
Rapid7 explains CISA's BOD 26-04, which sets a three-day remediation deadline for certain exploited flaws, and maps it to Rapid7 capabilities.
CISA issued Binding Operational Directive 26-04 on June 10, 2026, requiring remediation within three calendar days for vulnerabilities that are actively exploited, publicly reachable and grant full control, alongside a forensic investigation.
Rapid7 contrasts this with the 2026 Verizon DBIR's 43-day median remediation time.
The directive supersedes BOD 19-02 and BOD 22-01, replacing static CVSS and a flat 14-day KEV deadline with four variables derived from the SSVC framework: asset exposure, KEV status, exploit automation and technical impact.
The blog maps each requirement to Rapid7 capabilities.