How CISA BOD 26-04 redefines vulnerability management metrics for security leaders

Sicherheitsmeldung mit Schweregrad hoch. Sie wird laut CISA-KEV aktiv ausgenutzt und sollte priorisiert behandelt werden. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.

Originaltext der Quelle (nicht übersetzt) – die deutsche Zusammenfassung findest du im Tab „Kurzfassung".

CISA’s BOD 26-04 changes how federal agencies patch and how security leaders must measure, justify, and communicate cyber risk to executives and boards.Key takeawaysBOD 26-04 requires agencies to make and defend risk-based vulnerability prioritization decisions, including decisions to defer vulnerability remediation. This accountability requirement transforms vulnerability management from a technical operation into a governance discipline that demands audit-ready documentation. Traditional vulnerability management KPIs (total vulnerabilities patched, mean time to patch, percentage of systems scanned) do not measure what BOD 26-04 demands. The metrics that matter are coverage breadth and risk-tier remediation rates. Tenable’s analysis of customer telemetry shows that monitoring coverage breadth is a stronger predictor of risk posture than patch speed, a finding independently corroborated by research showing organizations can remediate only about 10% of open vulnerabilities per month regardless of size or maturity. The directive’s reach extends beyond federal agencies to thousands of federal contractors who must align with BOD 26-04 through contract compliance requirements. Organizations in the federal supply chain should treat the directive as an operational requirement, not advisory guidance. The shift from patching metrics to risk exposure metrics is not a federal-only phenomenon. Industry reporting standards, insurance underwriting models, and board-level accountability expectations are converging on the same demand: prove that you are reducing actual risk, not just …

Vollständiger Originalartikel ↗

• Betroffenheit im eigenen Stack prüfen: Versionen/Komponenten abgleichen.
• Originalquelle / Hersteller-Advisory lesen: https://www.tenable.com/blog/bod-26-04-ciso-reporting-risk-metrics
• Priorität HOCH: laut CISA-KEV aktiv ausgenutzt – bevorzugt patchen.
• Verfügbaren Patch oder Workaround einspielen und dokumentieren.
• Erkennung: Logs und Indikatoren (IoCs) auf Ausnutzung prüfen.