Your vulnerability scanner just flagged 3,847 issues. Federal agencies have a clear directive on which ones to fix first, and you should adopt their strategy.
CISA's Binding Operational Directive 26-04 establishes a risk-based framework for federal agencies to triage vulnerabilities. While BOD 26-04 applies only to Federal Civilian Executive Branch agencies, its logic can benefit any organization overwhelmed by scan results. The directive requires prioritizing rapid remediation of vulnerabilities listed in CISA's Known Exploited Vulnerabilities Catalog on publicly exposed assets that grant total control post-exploitation.
Here's a template to help you build your own vulnerability prioritization policy.
Purpose of This Template
This policy template provides a structured process for categorizing and prioritizing vulnerability remediation based on exploitability and asset exposure, not just CVSS scores. It sets clear timelines for different risk tiers and defines when your team should investigate potential system compromises before patching.
Use this template to:
- Move beyond "patch everything High and Critical" approaches that ignore real-world risk.
- Justify remediation timelines to leadership or auditors.
- Coordinate patching schedules across infrastructure, application, and security teams.
- Demonstrate a documented risk-based approach for ISO 27001 (A.12.6.1), NIST CSF (ID.RA, PR.IP), or similar frameworks.
Prerequisites
Before implementing this template, ensure you have:
Asset inventory with exposure classification, Identify which systems are internet-facing versus internal-only. Your CMDB or asset management system should include network zone data.
Vulnerability scanning coverage, Conduct regular authenticated scans of all in-scope systems, with results feeding into a central repository or GRC Platform.
Access to CISA's KEV Catalog feed, The catalog updates frequently. Set up automated monitoring via CISA's JSON feed or integrate it into your vulnerability management tools.
Defined asset criticality ratings, Know which systems are business-critical, contain sensitive data, or support regulatory obligations. This informs your Tier 2 prioritization.
Incident response contacts, For Tier 1 vulnerabilities, you may need to trigger compromise assessments. Confirm who conducts those investigations.
The Template
VULNERABILITY REMEDIATION PRIORITIZATION POLICY
1. SCOPE
This policy applies to all information systems owned or operated by [Organization Name], including cloud infrastructure, on-premises servers, network devices, and endpoints.
2. PRIORITIZATION TIERS
TIER 1: Immediate Action Required
Criteria:
- CVE is listed in CISA's Known Exploited Vulnerabilities Catalog, AND
- Affected asset is publicly exposed (internet-facing), AND
- Successful exploitation grants administrative control or allows arbitrary code execution
Remediation Timeline: [X] business days from vulnerability identification
Compromise Assessment Required: Yes, if the vulnerability existed on the asset before patching
TIER 2: Expedited Remediation
Criteria:
- CVE is listed in CISA's KEV Catalog but affects internal-only assets, OR
- Vulnerability affects business-critical systems (as defined in Asset Criticality Matrix) and has a CVSS base score ≥ 8.0, OR
- Vulnerability affects systems processing regulated data (PCI, HIPAA, etc.) with confirmed exploit code publicly available
Remediation Timeline: [Y] business days from vulnerability identification
Compromise Assessment Required: At discretion of Security Operations team
TIER 3: Standard Remediation
Criteria:
- CVSS base score ≥ 7.0 but does not meet Tier 1 or Tier 2 criteria, OR
- Vendor-issued security bulletin rates the vulnerability as "Critical" or "Important"
Remediation Timeline: [Z] business days from vulnerability identification
Compromise Assessment Required: No, unless triggered by other indicators
TIER 4: Deferred Remediation
Criteria:
- CVSS base score < 7.0, AND
- No evidence of active exploitation, AND
- Compensating controls reduce exploitability (e.g., network segmentation, authentication requirements)
Remediation Timeline: Addressed during next scheduled maintenance window or within [N] days, whichever is sooner
Compromise Assessment Required: No
3. KEV CATALOG MONITORING
The Security Operations team will monitor CISA's KEV Catalog daily via [automated feed / manual review / GRC Platform integration]. When a new CVE is added:
- Vulnerability Management team conducts scan correlation within 24 hours to identify affected assets
- Tier 1 remediation clock starts immediately upon asset identification
- Notification sent to asset owners and Security Leadership
4. COMPROMISE ASSESSMENT PROCESS
For Tier 1 vulnerabilities, the Incident Response team will:
- Review logs for indicators of exploitation attempts during the vulnerability window
- Check for unauthorized access, lateral movement, or data exfiltration patterns
- Document findings in the [Cybersecurity Risk Register](/glossary/cybersecurity-risk-register)
- Escalate to full incident response if compromise is confirmed
5. EXCEPTION PROCESS
Approved Exceptions to remediation timelines require:
- Written justification from asset owner
- Documentation of compensating controls
- Risk acceptance signature from [CISO / CIO / Risk Committee]
- Quarterly review of all active exceptions
6. METRICS AND REPORTING
The Vulnerability Management team will track:
- Mean time to remediate by tier
- Percentage of Tier 1 vulnerabilities patched within SLA
- Number of active Approved Exceptions by tier
- KEV Catalog vulnerabilities detected in environment vs. total KEV entries
Monthly reports to Security Leadership; quarterly reports to [Board / Audit Committee / Risk Committee].
7. POLICY REVIEW
This policy will be reviewed annually or when BOD 26-04 is updated, whichever occurs first.
How to Customize It
Remediation timelines: BOD 26-04 gives federal agencies specific deadlines based on asset type and vulnerability characteristics. Set your timelines based on operational reality. If you can't patch internet-facing systems in 15 days, start at 30 and work toward improvement. Document your current mean-time-to-remediate as a baseline.
Asset criticality matrix: Reference your existing business impact analysis or disaster recovery tier classifications. If you don't have formal criticality ratings, start with systems that process financial transactions, contain customer data, or support revenue-generating services.
Compromise assessment scope: Not every organization has a dedicated forensics team. For smaller teams, "compromise assessment" might mean reviewing authentication logs and checking for unusual admin account activity. Define what's realistic for your staffing level.
Exception authority: Align this with your existing risk acceptance process. Some organizations require Board-level sign-off for internet-facing exceptions; others delegate to the CISO for internal systems.
Tier 2 and 3 criteria: Adjust CVSS thresholds based on your risk appetite and patch capacity. If you're patching 200 vulnerabilities per month and still falling behind, tighten Tier 3 criteria to focus resources.
Validation Steps
After implementing this policy, verify it's working:
Run a KEV correlation scan, Pull the current KEV Catalog and cross-reference against your last vulnerability scan results. You should identify any KEV-listed vulnerabilities in your environment within 24 hours of catalog updates.
Test tier assignment logic, Take your last month's scan results and manually categorize 20 random vulnerabilities using the tier criteria. Compare your classifications against what your vulnerability management system assigned. Discrepancies indicate you need clearer criteria or better asset tagging.
Audit remediation timelines, For the past quarter, calculate actual remediation time for each tier. If Tier 1 average exceeds your policy SLA by more than 20%, you've set unrealistic timelines or need more patching resources.
Review exception documentation, Pull all active Approved Exceptions and verify each includes the required justification, compensating controls, and risk acceptance signature. Missing documentation indicates your exception process isn't being followed.
Validate compromise assessment triggers, Confirm that your last three Tier 1 remediations included documented compromise assessments. If they didn't, your incident response team may not understand their role in the process.
The KEV Catalog will keep growing. CISA recently added vulnerabilities like CVE-2015-3246 and CVE-2026-8452. Some of these are nearly a decade old, showing that attackers still exploit ancient vulnerabilities on exposed systems. Your prioritization framework must account for that reality, not just the latest zero-day headlines.
If you're aware of an exploited vulnerability not in the KEV Catalog, you can submit it through CISA's KEV Nomination Form. Submissions require a CVE ID, evidence of exploitation, and clear mitigation guidance.
