CINXE.COM
BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA
<!DOCTYPE html> <html lang="en" dir="ltr" prefix="og: https://ogp.me/ns#" class="no-js"> <head> <meta charset="utf-8" /> <meta name="description" content="This page contains a web-friendly version of the Cybersecurity and Infrastructure Security Agency’s Binding Operational Directive 22-01 - Reducing the" /> <link rel="canonical" href="https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities" /> <meta property="og:site_name" content="Cybersecurity and Infrastructure Security Agency CISA" /> <meta property="og:type" content="website" /> <meta property="og:url" content="https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities" /> <meta property="og:title" content="BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA" /> <meta name="Generator" content="Drupal 10 (https://www.drupal.org)" /> <meta name="MobileOptimized" content="width" /> <meta name="HandheldFriendly" content="true" /> <meta name="viewport" content="width=device-width, initial-scale=1.0" /> <link rel="icon" href="/profiles/cisad8_gov/themes/custom/gesso/favicon.png" type="image/png" /> <title>BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA</title> <link rel="stylesheet" media="all" href="/core/modules/system/css/components/align.module.css?snj5wy" /> <link rel="stylesheet" media="all" href="/core/modules/system/css/components/fieldgroup.module.css?snj5wy" /> <link rel="stylesheet" media="all" href="/core/modules/system/css/components/container-inline.module.css?snj5wy" /> <link rel="stylesheet" media="all" href="/core/modules/system/css/components/clearfix.module.css?snj5wy" /> <link rel="stylesheet" media="all" href="/core/modules/system/css/components/details.module.css?snj5wy" /> <link rel="stylesheet" media="all" href="/core/modules/system/css/components/hidden.module.css?snj5wy" /> <link rel="stylesheet" media="all" href="/core/modules/system/css/components/item-list.module.css?snj5wy" /> <link rel="stylesheet" media="all" href="/core/modules/system/css/components/js.module.css?snj5wy" /> <link rel="stylesheet" media="all" href="/core/modules/system/css/components/nowrap.module.css?snj5wy" /> <link rel="stylesheet" media="all" href="/core/modules/system/css/components/position-container.module.css?snj5wy" /> <link rel="stylesheet" media="all" href="/core/modules/system/css/components/reset-appearance.module.css?snj5wy" /> <link rel="stylesheet" media="all" href="/core/modules/system/css/components/resize.module.css?snj5wy" /> <link rel="stylesheet" media="all" href="/core/modules/system/css/components/system-status-counter.css?snj5wy" /> <link rel="stylesheet" media="all" href="/core/modules/system/css/components/system-status-report-counters.css?snj5wy" /> <link rel="stylesheet" media="all" href="/core/modules/system/css/components/system-status-report-general-info.css?snj5wy" /> <link rel="stylesheet" media="all" href="/core/modules/system/css/components/tablesort.module.css?snj5wy" /> <link rel="stylesheet" media="all" href="/core/misc/components/progress.module.css?snj5wy" /> <link rel="stylesheet" media="all" href="/core/misc/components/ajax-progress.module.css?snj5wy" /> <link rel="stylesheet" media="all" href="/core/modules/views/css/views.module.css?snj5wy" /> <link rel="stylesheet" media="all" href="/profiles/cisad8_gov/modules/custom/toolbar_tasks/css/toolbar.css?snj5wy" /> <link rel="stylesheet" media="all" href="/modules/contrib/extlink/css/extlink.css?snj5wy" /> <link rel="stylesheet" media="all" href="/modules/contrib/ckeditor_accordion/css/accordion.frontend.css?snj5wy" /> <link rel="stylesheet" media="all" href="/modules/contrib/better_social_sharing_buttons/css/better_social_sharing_buttons.css?snj5wy" /> <link rel="stylesheet" media="all" href="/modules/contrib/paragraphs/css/paragraphs.unpublished.css?snj5wy" /> <link rel="stylesheet" media="all" href="//fonts.googleapis.com/css2?family=Montserrat:wght@400;500;600;700&family=Public+Sans:wght@400;500;600;700&display=swap" /> <link rel="stylesheet" media="all" href="/profiles/cisad8_gov/themes/custom/gesso/dist/css/styles.css?snj5wy" /> <script type="application/json" data-drupal-selector="drupal-settings-json">{"path":{"baseUrl":"\/","pathPrefix":"","currentPath":"node\/8028","currentPathIsAdmin":false,"isFront":false,"currentLanguage":"en"},"pluralDelimiter":"\u0003","suppressDeprecationErrors":true,"gtm":{"tagId":null,"settings":{"data_layer":"dataLayer","include_classes":false,"allowlist_classes":"","blocklist_classes":"","include_environment":false,"environment_id":"","environment_token":""},"tagIds":["GTM-53QLXSL9"]},"gtag":{"tagId":"","consentMode":false,"otherIds":[],"events":[],"additionalConfigInfo":[]},"ajaxPageState":{"libraries":"eJxdjlGOwyAMRC9E4UjIYJewcXCETdvcflG36ar9GfmN7BknMqMeVXIFjrpAr63ENMykaVA7eLLLK2E16RFylo5VWnhP_tqlGTV09LC5vQbsYwf2L3RFpDBFgxLKlG_28AOPT3NzZegdNRSWBHzSRm1ErUgJ-ukZgVJ3O3QoHfZFz_Z_x4-2j8RVF0KnhxptIc0rZyI8o2aprjPpj9zQK2GRW3y9BA34sJo1sABe3njJ2Nyt0l3DU_0mOJh-AdfThJ8","theme":"guswds","theme_token":null},"ajaxTrustedUrl":[],"data":{"extlink":{"extTarget":false,"extTargetAppendNewWindowLabel":"(opens in a new window)","extTargetNoOverride":false,"extNofollow":false,"extNoreferrer":false,"extFollowNoOverride":false,"extClass":"ext","extLabel":"(link is external)","extImgClass":false,"extSubdomains":true,"extExclude":"(.\\.gov$)|(.\\.mil$)|(.\\.mil\/)|(.\\.gov\/)","extInclude":"","extCssExclude":".c-menu--social,.c-menu--footer,.c-social-links,.c-text-cta--button,.usa-footer__contact-info","extCssInclude":"","extCssExplicit":"","extAlert":true,"extAlertText":"You are now leaving an official website of the United State Government (USG), the Department of Homeland Security (DHS) and the Cybersecurity and Infrastructure Security Agency (CISA). Links to non-USG, non-DHS and non-CISA sites are provided for the visitor\u0027s convenience and do not represent an endorsement by USG, DHS or CISA of any commercial or private issues, products or services. Note that the privacy policy of the linked site may differ from that of USG, DHS and CISA.","extHideIcons":false,"mailtoClass":"mailto","telClass":"","mailtoLabel":"(link sends email)","telLabel":"(link is a phone number)","extUseFontAwesome":false,"extIconPlacement":"append","extFaLinkClasses":"fa fa-external-link","extFaMailtoClasses":"fa fa-envelope-o","extAdditionalLinkClasses":"","extAdditionalMailtoClasses":"","extAdditionalTelClasses":"","extFaTelClasses":"fa fa-phone","whitelistedDomains":[],"extExcludeNoreferrer":""}},"ckeditorAccordion":{"accordionStyle":{"collapseAll":1,"keepRowsOpen":0,"animateAccordionOpenAndClose":1,"openTabsWithHash":1}},"user":{"uid":0,"permissionsHash":"0f75d40308887aebba0d5b0d2671305b73c9431902f86e672380a6dc6ab97d07"}}</script> <script src="/core/assets/vendor/jquery/jquery.min.js?v=3.7.1"></script> <script src="/core/assets/vendor/once/once.min.js?v=1.0.1"></script> <script src="/core/misc/drupalSettingsLoader.js?v=10.3.6"></script> <script src="/core/misc/drupal.js?v=10.3.6"></script> <script src="/core/misc/drupal.init.js?v=10.3.6"></script> <script src="/core/assets/vendor/tabbable/index.umd.min.js?v=6.2.0"></script> <script src="/modules/contrib/google_tag/js/gtm.js?snj5wy"></script> <script src="/modules/contrib/google_tag/js/gtag.js?snj5wy"></script> <script src="/core/misc/progress.js?v=10.3.6"></script> <script src="/core/assets/vendor/loadjs/loadjs.min.js?v=4.3.0"></script> <script src="/core/misc/debounce.js?v=10.3.6"></script> <script src="/core/misc/announce.js?v=10.3.6"></script> <script src="/core/misc/message.js?v=10.3.6"></script> <script src="/core/misc/ajax.js?v=10.3.6"></script> <script src="/modules/contrib/google_tag/js/gtag.ajax.js?snj5wy"></script> </head> <body class="path-node not-front node-page node-page--node-type-directive" id="top"> <div class="c-skiplinks"> <a href="#main" class="c-skiplinks__link u-visually-hidden u-focusable">Skip to main content</a> </div> <noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-53QLXSL9" height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript> <div class="dialog-off-canvas-main-canvas" data-off-canvas-main-canvas> <div class="l-site-container"> <section class="usa-banner" aria-label="Official government website"> <div class="usa-accordion"> <header class="usa-banner__header"> <div class="usa-banner__inner"> <div class="grid-col-auto"> <img class="usa-banner__header-flag" src="/profiles/cisad8_gov/themes/custom/gesso/dist/images/us_flag_small.png" alt="U.S. flag" /> </div> <div class="grid-col-fill tablet:grid-col-auto"> <p class="usa-banner__header-text">An official website of the United States government</p> <p class="usa-banner__header-action" aria-hidden="true">Here’s how you know</p></div> <button class="usa-accordion__button usa-banner__button" aria-expanded="false" aria-controls="gov-banner"> <span class="usa-banner__button-text">Here’s how you know</span> </button> </div> </header> <div class="usa-banner__content usa-accordion__content" id="gov-banner"> <div class="grid-row grid-gap-lg"> <div class="usa-banner__guidance tablet:grid-col-6"> <img class="usa-banner__icon usa-media-block__img" src="/profiles/cisad8_gov/themes/custom/gesso/dist/images/icon-dot-gov.svg" alt="Dot gov"> <div class="usa-media-block__body"> <p> <strong>Official websites use .gov</strong> <br> A <strong>.gov</strong> website belongs to an official government organization in the United States. </p> </div> </div> <div class="usa-banner__guidance tablet:grid-col-6"> <img class="usa-banner__icon usa-media-block__img" src="/profiles/cisad8_gov/themes/custom/gesso/dist/images/icon-https.svg" alt="HTTPS"> <div class="usa-media-block__body"> <p> <strong>Secure .gov websites use HTTPS</strong> <br> A <strong>lock</strong> (<span class="icon-lock"><svg xmlns="http://www.w3.org/2000/svg" width="52" height="64" viewBox="0 0 52 64" class="usa-banner__lock-image" role="img" aria-labelledby="banner-lock-title banner-lock-description"><title id="banner-lock-title">Lock</title><desc id="banner-lock-description">A locked padlock</desc><path fill="#000000" fill-rule="evenodd" d="M26 0c10.493 0 19 8.507 19 19v9h3a4 4 0 0 1 4 4v28a4 4 0 0 1-4 4H4a4 4 0 0 1-4-4V32a4 4 0 0 1 4-4h3v-9C7 8.507 15.507 0 26 0zm0 8c-5.979 0-10.843 4.77-10.996 10.712L15 19v9h22v-9c0-6.075-4.925-11-11-11z"/></svg></span>) or <strong>https://</strong> means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites. </p> </div> </div> </div> </div> </div> </section> <div class="c-block c-global-header-btns c-global-btns"> <div class="l-constrain l-constrain"> <div class="c-block__content"> <div id="block-globalbuttons" class="c-block c-block--provider-block-content c-block--id-block-content83069f9f-34fc-4d54-86ec-936a204f8088"> <div class="c-block__content"> <div class="c-field c-field--name-body c-field--type-text-with-summary c-field--label-hidden"> <div class="c-field__content"><p><a class="c-button c-button--basic c-button--blue" href="/resources-tools/resources/free-cybersecurity-services-and-tools" title="Free Cyber Services">Free Cyber Services</a><a class="c-button c-button--basic c-button--green60" href="/topics/election-security/election-threat-updates">Election Threat Updates</a><a class="c-button c-button--basic c-button--gray" href="/protect2024">#protect2024</a><a class="c-button c-button--basic c-button--teal" href="/node/18883">Secure Our World</a><a class="c-button c-button--campaign" href="/node/8056">Shields Up</a><a class="c-button c-button--report" href="/report">Report A Cyber Issue</a></p></div></div> </div> </div> </div> </div> </div> <div class="usa-overlay"></div> <header class="usa-header usa-header--extended" role="banner"> <div class="usa-navbar"> <div class="l-constrain"> <div class="usa-navbar__row"> <div class="c-block c-site-header"> <div class="l-constrain"> <div class="c-block__content"> <div id="block-guswds-cisaheaderblock" class="c-block c-block--provider-block-content c-block--id-block-contentbc4e6844-86b4-4e20-b163-a73bda3d1d76"> <div class="c-block__content"> <div class="c-field c-field--name-body c-field--type-text-with-summary c-field--label-hidden"> <div class="c-field__content"><a href="/"><img src = "/sites/default/files/images/SVG/header_logo_tagline_update.svg" alt="CISA logo image. America's Cyber Defense Agency, National Coordinator for Critical Infrastructure Security and Resilience"/></a></div></div> </div> </div> </div> </div> </div> <div class="c-block c-site-header-mobile"> <div class="l-constrain"> <div class="c-block__content"> <div id="block-guswds-cisaheaderblockmobile" class="c-block c-block--provider-block-content c-block--id-block-content283396c9-cd36-4ce3-b1e2-9b5576ab4f50"> <div class="c-block__content"> <div class="c-field c-field--name-body c-field--type-text-with-summary c-field--label-hidden"> <div class="c-field__content"><a href="/"><img src = "/sites/default/files/images/SVG/mobile_logo_wordmark.svg" alt="CISA Logo"/></a></div></div> </div> </div> </div> </div> </div> <div class="usa-navbar__search"> <div class="usa-navbar__search-header"> <p>Search</p> </div> <div class="usa-search"> <script async src=https://cse.google.com/cse.js?cx=ffc4c79e29d5b3a8c></script> <div class="gcse-searchbox-only" data-resultsurl="/search"> </div> </div> </div> <button class="mobile-menu-button usa-menu-btn">Menu</button> </div> </div> </div> <div class="c-block c-tagline-mobile"> <div class="l-constrain"> <div class="c-block__content"> <div id="block-guswds-mobiletaglinecontainer" class="c-block c-block--provider-block-content c-block--id-block-contentc8d12e9d-7e48-4708-90c1-563609c4b566"> <div class="c-block__content"> <div class="c-field c-field--name-body c-field--type-text-with-summary c-field--label-hidden"> <div class="c-field__content"><p><center><img src = "/sites/default/files/images/SVG/header_tagline_mobile_update.svg" alt = "America's Cyber Defense Agency" /></center></div></div> </div> </div> </div> </div> </div> <nav class="usa-nav" role="navigation" aria-label="Primary navigation"> <div class="usa-nav__inner l-constrain"> <div class="usa-nav__row"> <button class="usa-nav__close">Close</button> <div class="usa-search"> <script async src=https://cse.google.com/cse.js?cx=ffc4c79e29d5b3a8c></script> <div class="gcse-searchbox-only" data-resultsurl="/search"> </div> </div> <ul class="usa-nav__primary usa-accordion"> <li class="usa-nav__primary-item topics"> <button class="usa-accordion__button usa-nav__link " aria-expanded="false" aria-controls="basic-mega-nav-section-1"> <span>Topics</span> </button> <div id="basic-mega-nav-section-1" class="usa-nav__submenu usa-megamenu" hidden=""> <div class="usa-megamenu__parent-link"> <a href="/topics">Topics</a> </div> <div class="usa-megamenu__menu-items"> <div class="usa-col"> <div class="usa-nav__submenu-item"> <a href="/topics/cybersecurity-best-practices"> <span>Cybersecurity Best Practices</span> </a> </div> </div> <div class="usa-col"> <div class="usa-nav__submenu-item"> <a href="/topics/cyber-threats-and-advisories"> <span>Cyber Threats and Advisories</span> </a> </div> </div> <div class="usa-col"> <div class="usa-nav__submenu-item"> <a href="/topics/critical-infrastructure-security-and-resilience"> <span>Critical Infrastructure Security and Resilience</span> </a> </div> </div> <div class="usa-col"> <div class="usa-nav__submenu-item"> <a href="/topics/election-security"> <span>Election Security</span> </a> </div> </div> <div class="usa-col"> <div class="usa-nav__submenu-item"> <a href="/topics/emergency-communications"> <span>Emergency Communications</span> </a> </div> </div> <div class="usa-col"> <div class="usa-nav__submenu-item"> <a href="/topics/industrial-control-systems"> <span>Industrial Control Systems</span> </a> </div> </div> <div class="usa-col"> <div class="usa-nav__submenu-item"> <a href="/topics/information-communications-technology-supply-chain-security"> <span>Information and Communications Technology Supply Chain Security</span> </a> </div> </div> <div class="usa-col"> <div class="usa-nav__submenu-item"> <a href="/topics/partnerships-and-collaboration"> <span>Partnerships and Collaboration</span> </a> </div> </div> <div class="usa-col"> <div class="usa-nav__submenu-item"> <a href="/topics/physical-security"> <span>Physical Security</span> </a> </div> </div> <div class="usa-col"> <div class="usa-nav__submenu-item"> <a href="/topics/risk-management"> <span>Risk Management</span> </a> </div> </div> </div> <div class="c-menu-feature-links"> <div class="c-menu-feature-links__title"> <a href="/audiences"> How can we help? </a> </div> <div class="c-menu-feature-links__content"><a href="/topics/government">Government</a><a href="/topics/educational-institutions">Educational Institutions</a><a href="/topics/industry">Industry</a><a href="/topics/state-local-tribal-and-territorial">State, Local, Tribal, and Territorial</a><a href="/topics/individuals-and-families">Individuals and Families</a><a href="/topics/small-and-medium-businesses">Small and Medium Businesses</a><a href="/audiences/find-help-locally">Find Help Locally</a><a href="/audiences/faith-based-community">Faith-Based Community</a><a href="/audiences/executives">Executives</a><a href="/audiences/high-risk-communities">High-Risk Communities</a></div> </div> </div> </li> <li class="usa-nav__primary-item spotlight"> <a href="/spotlight" class="usa-nav__link" > <span>Spotlight</span> </a> </li> <li class="usa-nav__primary-item resources--tools"> <button class="usa-accordion__button usa-nav__link " aria-expanded="false" aria-controls="basic-mega-nav-section-3"> <span>Resources & Tools</span> </button> <div id="basic-mega-nav-section-3" class="usa-nav__submenu usa-megamenu" hidden=""> <div class="usa-megamenu__parent-link"> <a href="/resources-tools">Resources & Tools</a> </div> <div class="usa-megamenu__menu-items"> <div class="usa-col"> <div class="usa-nav__submenu-item"> <a href="/resources-tools/all-resources-tools"> <span>All Resources & Tools</span> </a> </div> </div> <div class="usa-col"> <div class="usa-nav__submenu-item"> <a href="/resources-tools/services"> <span>Services</span> </a> </div> </div> <div class="usa-col"> <div class="usa-nav__submenu-item"> <a href="/resources-tools/programs"> <span>Programs</span> </a> </div> </div> <div class="usa-col"> <div class="usa-nav__submenu-item"> <a href="/resources-tools/resources"> <span>Resources</span> </a> </div> </div> <div class="usa-col"> <div class="usa-nav__submenu-item"> <a href="/resources-tools/training"> <span>Training</span> </a> </div> </div> <div class="usa-col"> <div class="usa-nav__submenu-item"> <a href="/resources-tools/groups"> <span>Groups</span> </a> </div> </div> </div> </div> </li> <li class="usa-nav__primary-item news--events"> <button class="usa-accordion__button usa-nav__link usa-current" aria-expanded="false" aria-controls="basic-mega-nav-section-4"> <span>News & Events</span> </button> <div id="basic-mega-nav-section-4" class="usa-nav__submenu usa-megamenu" hidden=""> <div class="usa-megamenu__parent-link"> <a href="/news-events">News & Events</a> </div> <div class="usa-megamenu__menu-items"> <div class="usa-col"> <div class="usa-nav__submenu-item"> <a href="/news-events/news"> <span>News</span> </a> </div> </div> <div class="usa-col"> <div class="usa-nav__submenu-item"> <a href="/news-events/events"> <span>Events</span> </a> </div> </div> <div class="usa-col"> <div class="usa-nav__submenu-item"> <a href="/news-events/cybersecurity-advisories"> <span>Cybersecurity Alerts & Advisories</span> </a> </div> </div> <div class="usa-col"> <div class="usa-nav__submenu-item"> <a href="/news-events/directives"> <span>Directives</span> </a> </div> </div> <div class="usa-col"> <div class="usa-nav__submenu-item"> <a href="/news-events/request-speaker"> <span>Request a CISA Speaker</span> </a> </div> </div> <div class="usa-col"> <div class="usa-nav__submenu-item"> <a href="/news-events/congressional-testimony"> <span>Congressional Testimony</span> </a> </div> </div> <div class="usa-col"> <div class="usa-nav__submenu-item"> <a href="/cisa-conferences"> <span>CISA Conferences</span> </a> </div> </div> <div class="usa-col"> <div class="usa-nav__submenu-item"> <a href="/cisa-live"> <span>CISA Live!</span> </a> </div> </div> </div> </div> </li> <li class="usa-nav__primary-item careers"> <button class="usa-accordion__button usa-nav__link " aria-expanded="false" aria-controls="basic-mega-nav-section-5"> <span>Careers</span> </button> <div id="basic-mega-nav-section-5" class="usa-nav__submenu usa-megamenu" hidden=""> <div class="usa-megamenu__parent-link"> <a href="/careers">Careers</a> </div> <div class="usa-megamenu__menu-items"> <div class="usa-col"> <div class="usa-nav__submenu-item"> <a href="/careers/benefits-perks"> <span>Benefits & Perks</span> </a> </div> </div> <div class="usa-col"> <div class="usa-nav__submenu-item"> <a href="/careers/hirevue-applicant-reasonable-accommodations-process"> <span>HireVue Applicant Reasonable Accommodations Process</span> </a> </div> </div> <div class="usa-col"> <div class="usa-nav__submenu-item"> <a href="/general-recruitment-and-hiring-faqs"> <span>Hiring</span> </a> </div> </div> <div class="usa-col"> <div class="usa-nav__submenu-item"> <a href="/careers/resume-application-tips"> <span>Resume & Application Tips</span> </a> </div> </div> <div class="usa-col"> <div class="usa-nav__submenu-item"> <a href="/students-recent-graduates-employment-opportunities"> <span>Students & Recent Graduates</span> </a> </div> </div> <div class="usa-col"> <div class="usa-nav__submenu-item"> <a href="/careers/veteran-and-military-spouse-employment-opportunities"> <span>Veteran and Military Spouses</span> </a> </div> </div> <div class="usa-col"> <div class="usa-nav__submenu-item"> <a href="/careers/work-cisa"> <span>Work @ CISA</span> </a> </div> </div> </div> </div> </li> <li class="usa-nav__primary-item about"> <button class="usa-accordion__button usa-nav__link " aria-expanded="false" aria-controls="basic-mega-nav-section-6"> <span>About</span> </button> <div id="basic-mega-nav-section-6" class="usa-nav__submenu usa-megamenu" hidden=""> <div class="usa-megamenu__parent-link"> <a href="/about">About</a> </div> <div class="usa-megamenu__menu-items"> <div class="usa-col"> <div class="usa-nav__submenu-item"> <a href="/about/culture"> <span>Culture</span> </a> </div> </div> <div class="usa-col"> <div class="usa-nav__submenu-item"> <a href="/about/divisions-offices"> <span>Divisions & Offices</span> </a> </div> </div> <div class="usa-col"> <div class="usa-nav__submenu-item"> <a href="/about/regions"> <span>Regions</span> </a> </div> </div> <div class="usa-col"> <div class="usa-nav__submenu-item"> <a href="/about/leadership"> <span>Leadership</span> </a> </div> </div> <div class="usa-col"> <div class="usa-nav__submenu-item"> <a href="/doing-business-cisa"> <span>Doing Business with CISA</span> </a> </div> </div> <div class="usa-col"> <div class="usa-nav__submenu-item"> <a href="/site-links"> <span>Site Links</span> </a> </div> </div> <div class="usa-col"> <div class="usa-nav__submenu-item"> <a href="/reporting-employee-and-contractor-misconduct"> <span>Reporting Employee and Contractor Misconduct</span> </a> </div> </div> <div class="usa-col"> <div class="usa-nav__submenu-item"> <a href="/cisa-github"> <span>CISA GitHub</span> </a> </div> </div> <div class="usa-col"> <div class="usa-nav__submenu-item"> <a href="/cisa-central"> <span>CISA Central</span> </a> </div> </div> <div class="usa-col"> <div class="usa-nav__submenu-item"> <a href="/about/2023YIR"> <span>2023 Year In Review</span> </a> </div> </div> <div class="usa-col"> <div class="usa-nav__submenu-item"> <a href="/about/contact-us"> <span>Contact Us </span> </a> </div> </div> <div class="usa-col"> <div class="usa-nav__submenu-item"> <a href="/about/contact-us/subscribe-updates-cisa"> <span>Subscribe</span> </a> </div> </div> </div> </div> </li> </ul> <div class="c-block c-global-menu-btns c-global-btns"> <div class="c-block__content"> <div id="block-globalbuttons" class="c-block c-block--provider-block-content c-block--id-block-content83069f9f-34fc-4d54-86ec-936a204f8088"> <div class="c-block__content"> <div class="c-field c-field--name-body c-field--type-text-with-summary c-field--label-hidden"> <div class="c-field__content"><p><a class="c-button c-button--basic c-button--blue" href="/resources-tools/resources/free-cybersecurity-services-and-tools" title="Free Cyber Services">Free Cyber Services</a><a class="c-button c-button--basic c-button--green60" href="/topics/election-security/election-threat-updates">Election Threat Updates</a><a class="c-button c-button--basic c-button--gray" href="/protect2024">#protect2024</a><a class="c-button c-button--basic c-button--teal" href="/node/18883">Secure Our World</a><a class="c-button c-button--campaign" href="/node/8056">Shields Up</a><a class="c-button c-button--report" href="/report">Report A Cyber Issue</a></p></div></div> </div> </div> </div> </div> </div> </div> </nav> </header> <div class="l-breadcrumb"> <div class="l-constrain"> <div class="l-breadcrumb__row"> <nav aria-labelledby="breadcrumb-label" class="c-breadcrumb" role="navigation"> <div class="l-constrain"> <div id="breadcrumb-label" class="c-breadcrumb__title u-visually-hidden">Breadcrumb</div> <ol class="c-breadcrumb__list"> <li class="c-breadcrumb__item"> <a class="c-breadcrumb__link" href="/">Home</a> </li> <li class="c-breadcrumb__item"> <a class="c-breadcrumb__link" href="/news-events">News & Events</a> </li> <li class="c-breadcrumb__item"> <a class="c-breadcrumb__link" href="/news-events/directives">Cybersecurity Directives</a> </li> </ol> </div> </nav> <div id="block-bettersocialsharingbuttons" class="c-block c-block--social-share c-block--provider-better-social-sharing-buttons c-block--id-social-sharing-buttons-block"> <div class="c-block__content"> <div class="c-block__row"> <span>Share:</span> <div style="display: none"><link rel="preload" href="/modules/contrib/better_social_sharing_buttons/assets/dist/sprites/social-icons--no-color.svg" as="image" type="image/svg+xml" crossorigin="anonymous" /></div> <div class="social-sharing-buttons"> <a href="https://www.facebook.com/sharer/sharer.php?u=https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities&title=BOD%2022-01%3A%20Reducing%20the%20Significant%20Risk%20of%20Known%20Exploited%20Vulnerabilities" target="_blank" title="Share to Facebook" aria-label="Share to Facebook" class="social-sharing-buttons__button share-facebook" rel="noopener"> <svg width="18px" height="18px" style="border-radius:3px;"> <use href="/modules/contrib/better_social_sharing_buttons/assets/dist/sprites/social-icons--no-color.svg#facebook" /> </svg> </a> <a href="https://twitter.com/intent/tweet?text=BOD%2022-01%3A%20Reducing%20the%20Significant%20Risk%20of%20Known%20Exploited%20Vulnerabilities+https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities" target="_blank" title="Share to X" aria-label="Share to X" class="social-sharing-buttons__button share-x" rel="noopener"> <svg width="18px" height="18px" style="border-radius:3px;"> <use href="/modules/contrib/better_social_sharing_buttons/assets/dist/sprites/social-icons--no-color.svg#x" /> </svg> </a> <a href="https://www.linkedin.com/sharing/share-offsite/?url=https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities" target="_blank" title="Share to Linkedin" aria-label="Share to Linkedin" class="social-sharing-buttons__button share-linkedin" rel="noopener"> <svg width="18px" height="18px" style="border-radius:3px;"> <use href="/modules/contrib/better_social_sharing_buttons/assets/dist/sprites/social-icons--no-color.svg#linkedin" /> </svg> </a> <a href="mailto:?subject=BOD%2022-01%3A%20Reducing%20the%20Significant%20Risk%20of%20Known%20Exploited%20Vulnerabilities&body=https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities" title="Share to Email" aria-label="Share to Email" class="social-sharing-buttons__button share-email" target="_blank" rel="noopener"> <svg width="18px" height="18px" style="border-radius:3px;"> <use href="/modules/contrib/better_social_sharing_buttons/assets/dist/sprites/social-icons--no-color.svg#email" /> </svg> </a> </div> </div> </div> </div> </div> </div> </div> <main id="main" class="c-main" role="main" tabindex="-1"> <div class="l-content"> <div class="l-sidebar has-aside-left has-no-header has-no-header"> <div class="l-sidebar__row"> <aside class="l-sidebar__left"> <div id="block-sidenavigation" class="c-block c-block--sidenav c-block--provider-menu-block c-block--id-menu-blockmain"> <h2 class="c-block__title"><a href="/news-events" class="menu-item--active-trail" data-drupal-link-system-path="node/7332">News & Events</a></h2> <div class="c-block__content"> <ul class="usa-nav__primary usa-accordion"> <li class="usa-nav__primary-item news"> <a href="/news-events/news" class="usa-nav__link" > <span>News</span> </a> </li> <li class="usa-nav__primary-item events"> <a href="/news-events/events" class="usa-nav__link" > <span>Events</span> </a> </li> <li class="usa-nav__primary-item cybersecurity-alerts--advisories"> <a href="/news-events/cybersecurity-advisories" class="usa-nav__link" > <span>Cybersecurity Alerts & Advisories</span> </a> </li> <li class="usa-nav__primary-item directives"> <a href="/news-events/directives" class="usa-nav__link usa-current" > <span>Directives</span> </a> </li> <li class="usa-nav__primary-item request-a-cisa-speaker"> <a href="/news-events/request-speaker" class="usa-nav__link" > <span>Request a CISA Speaker</span> </a> </li> <li class="usa-nav__primary-item congressional-testimony"> <a href="/news-events/congressional-testimony" class="usa-nav__link" > <span>Congressional Testimony</span> </a> </li> <li class="usa-nav__primary-item cisa-conferences"> <a href="/cisa-conferences" class="usa-nav__link" > <span>CISA Conferences</span> </a> </li> <li class="usa-nav__primary-item cisa-live"> <a href="/cisa-live" class="usa-nav__link" > <span>CISA Live!</span> </a> </li> </ul> </div> </div> </aside> <div class="l-sidebar__main"> <div class="c-page-title has-no-header"> <div class="c-page-title__inner l-constrain"> <div class="c-page-title__row"> <div class="c-page-title__content"> <div class="c-page-title__meta">Binding Operational Directives</div> <h1 class="c-page-title__title"> <span>BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities</span> </h1> <div class="c-page-title__date"><time datetime="2021-11-03T12:00:00Z">November 03, 2021</time> </div> <div class="c-page-title__topic"> <div class="c-topic__label"> Related topics: </div> <div class="c-top__topics"> <a href="/topics/cybersecurity-best-practices">Cybersecurity Best Practices</a> </div> </div> </div> </div> <div class="c-page-title__decoration"></div> </div> </div> <div class="l-page-section l-page-section--rich-text"> <div class="l-constrain"> <div class="l-page-section__content"> <p>This page contains a web-friendly version of the Cybersecurity and Infrastructure Security Agency’s Binding Operational Directive 22-01 - Reducing the Significant Risk of Known Exploited Vulnerabilities.</p> <p>A binding operational directive is a <a href="https://uscode.house.gov/view.xhtml?req=(title:44%20section:3552%20edition:prelim)%20OR%20(granuleid:USC-prelim-title44-section3552)&f=treesort&edition=prelim&num=0&jumpTo=true" title="compulsory direction">compulsory direction</a> to federal, executive branch, departments and agencies for purposes of safeguarding federal information and information systems.</p> <p><a href="https://uscode.house.gov/view.xhtml?hl=false&edition=prelim&req=granuleid%3AUSC-prelim-title44-section3553&f=treesort&num=0&saved=%7CKHRpdGxlOjQ0IHNlY3Rpb246MzU1MiBlZGl0aW9uOnByZWxpbSkgT1IgKGdyYW51bGVpZDpVU0MtcHJlbGltLXRpdGxlNDQtc2VjdGlvbjM1NTIp%7CdHJlZXNvcnQ%3D%7C%7C0%7Cfalse%7Cprelim" title="Section 3553(b)(2) of title 44, U.S. Code">Section 3553(b)(2) of title 44, U.S. Code</a>, authorizes the Secretary of the Department of Homeland Security (DHS) to develop and oversee the implementation of binding operational directives.</p> <p>Federal agencies are <a href="https://uscode.house.gov/view.xhtml?req=(title:44%20section:3554%20edition:prelim)%20OR%20(granuleid:USC-prelim-title44-section3554)&f=treesort&edition=prelim&num=0&jumpTo=true" title="required ">required</a> to comply with DHS-developed directives.</p> <p>These directives <a href="https://uscode.house.gov/view.xhtml?req=(title:44%20section:3553%20edition:prelim)%20OR%20(granuleid:USC-prelim-title44-section3553)&f=treesort&edition=prelim&num=0&jumpTo=true" title="do not apply">do not apply</a> to statutorily defined “national security systems” nor to certain systems operated by the Department of Defense or the Intelligence Community.</p> <h3>Background</h3> <p>The United States faces persistent and increasingly sophisticated malicious cyber campaigns that threaten the public sector, the private sector, and ultimately the American people’s security and privacy. The federal government must improve its efforts to protect against these campaigns by ensuring the security of information technology assets across the federal enterprise. Vulnerabilities that have previously been used to exploit public and private organizations are a frequent attack vector for malicious cyber actors of all types. These vulnerabilities pose significant risk to agencies and the federal enterprise. It is essential to aggressively remediate known exploited vulnerabilities to protect federal information systems and reduce cyber incidents.</p> <p>This directive establishes a CISA-managed catalog of known <a href="/known-exploited-vulnerabilities-catalog" title="Known Exploited Vulnerabilities Catalog">exploited vulnerabilities that carry significant risk to the federal enterprise</a> and establishes requirements for agencies to remediate any such vulnerabilities included in the catalog. CISA will determine vulnerabilities warranting inclusion in the catalog based on reliable evidence that the exploit is being actively used to exploit public or private organizations by a threat actor. This directive enhances but does not replace BOD 19-02, which addresses remediation requirements for critical and high vulnerabilities on internet-facing federal information systems identified through CISA’s vulnerability scanning service.</p> <h4>Scope</h4> <p>This directive applies to all software and hardware found on federal information systems managed on agency premises or hosted by third parties on an agency’s behalf. These required actions apply to any federal information system, including an information system used or operated by another entity on behalf of an agency, that collects, processes, stores, transmits, disseminates, or otherwise maintains agency information.</p> <h3>Required Actions</h3> <div class="accordion_fold"> <ol> <li> <p>Within 60 days of issuance, agencies shall review and update agency internal vulnerability management procedures in accordance with this Directive. If requested by CISA, agencies will provide a copy of these policies and procedures. At a minimum, agency policies must:</p> <ol> <li> <p>Establish a process for ongoing remediation of vulnerabilities that CISA identifies, through inclusion in the CISA-managed catalog of known exploited vulnerabilities, as carrying significant risk to the federal enterprise within a timeframe set by CISA pursuant to this directive;</p> </li> <li> <p> Assign roles and responsibilities for executing agency actions as required by this directive;</p> </li> <li> <p>Define necessary actions required to enable prompt response to actions required by this directive;</p> </li> <li> <p>Establish internal validation and enforcement procedures to ensure adherence with this Directive; and</p> </li> <li> <p>Set internal tracking and reporting requirements to evaluate adherence with this Directive and provide reporting to CISA, as needed.</p> </li> </ol> </li> <li> <p>Remediate each vulnerability according to the timelines set forth in the CISA-managed vulnerability catalog. The catalog will list exploited vulnerabilities that carry significant risk to the federal enterprise with the requirement to remediate within 6 months for vulnerabilities with a Common Vulnerabilities and Exposures (CVE) ID assigned prior to 2021 and within two weeks for all other vulnerabilities. These default timelines may be adjusted in the case of grave risk to the Federal Enterprise.</p> </li> <li> <p>Report on the status of vulnerabilities listed in the repository. In line with requirements for the Continuous Diagnostics and Mitigation (CDM) Federal Dashboard deployment and OMB annual FISMA memorandum requirements, agencies are expected to automate data exchange and report their respective Directive implementation status through the CDM Federal Dashboard. Initially agencies may submit quarterly reports through CyberScope submissions or report through the CDM Federal Dashboard. Starting on October 1, 2022, agencies that have not migrated reporting to the CDM Federal Dashboard will be required to update their status through CyberScope bi-weekly.</p> </li> </ol> </div> <h3 id="cisa-actions">CISA Actions</h3> <div class="accordion_fold"> <ol> <li>Maintain the catalog of known exploited vulnerabilities at cisa.gov/known-exploited-vulnerabilities-catalog and alert agencies of updates for awareness and action.</li> <li>CISA will publish the thresholds and conditions for including and adding vulnerabilities to the catalog at cisa.gov/known-exploited-vulnerabilities-catalog.</li> <li>As necessary following the issuance of this Directive, CISA will review this Directive to account for changes in the general cybersecurity landscape and consider issuing Supplemental Direction to incorporate additional vulnerability management best practices for federal information systems.</li> <li>Annually, by the end of each fiscal year, provide a status report to the Secretary of Homeland Security, the Director of the Office of Management and Budget (OMB), and the National Cyber Director identifying cross-agency status and outstanding issues in implementation of this Directive.</li> </ol> </div> <h3 id="frequently-asked-questions">Frequently Asked Questions</h3> <div class="accordion_fold"> <h4 id="what-is-the-difference-between-vulnerabilities-listed-in-the-national-vulnerability-database-nvd-and-those-in-cisas-catalog-of-known-exploited-vulnerabilities-kevs">What is the difference between vulnerabilities listed in the National Vulnerability Database (NVD) and those in CISA’s catalog of Known Exploited Vulnerabilities (KEVs)?</h4> <p>The NVD lists all publicly known vulnerabilities with a Common Vulnerabilities and Exposures (CVE) ID assigned. The NVD database currently includes more than 160,000 unique CVEs, and is constantly growing. Each vulnerability is scored based on several factors, including impact and ease of execution. However, the Common Vulnerability Scoring System (CVSS) base score does not account for if the vulnerability is actually being used to attack systems. Our experts have observed that attackers do not rely only on “critical” vulnerabilities to achieve their goals; some of the most widespread and devastating attacks have included multiple vulnerabilities rated “high”, “medium”, or even “low”. This methodology, known as “chaining”, uses lower score vulnerabilities to first gain a foothold, then exploit additional vulnerabilities to escalate privilege on an incremental basis.</p> <p>Also, many vulnerabilities classified as “critical” are highly complex and have never been seen exploited in the wild - in fact, less than 4% of the total number of CVEs have been publicly exploited. But threat actors are extremely fast to exploit their vulnerabilities of choice: of those 4% of known exploited CVEs, 42% are being used on day 0 of disclosure; 50% within 2 days; and 75% within 28 days.</p> <h4 id="what-is-more-important-to-remediate-first---critical-and-high-or-known-exploited-vulnerabilities">What is more important to remediate first – critical and high or known exploited vulnerabilities?</h4> <p>Known exploited vulnerabilities should be the top priority for remediation. Based on a study of historical vulnerability data dating back to 2019, less than 4% of all known vulnerabilities have been used by attackers in the wild<a>.</a> Rather than have agencies focus on thousands of vulnerabilities that may never be used in a real-world attack, BOD 22-01 shifts the focus to those vulnerabilities that are active threats. CISA acknowledges CVSS scoring can still be a part of an organization’s vulnerability management efforts, especially with machine-to-machine communication and large-scale automation. Keep in mind that this Directive is intended to help agencies prioritize their remediation work; it does not release them from any of their compliance obligations, including the resolution of other vulnerabilities.</p> <h4 id="with-extended-telework-most-of-our-workstations-are-remote-and-hard-to-patch-does-cisa-have-any-recommendations-for-patching-roaming-and-nomadic-devices">With extended telework, most of our workstations are remote and hard to update, does CISA have any recommendations for updating roaming and nomadic devices?</h4> <p>Recent increases in teleworking have amplified these issues and made updating and securing remote and roaming devices more challenging. CISA has published a <a href="/sites/default/files/2023-01/08.20.20_CISA_CEG_Remote_Patch_Management-508_1.pdf" title="Capacity Enhancement Guide on Remote Patch and Vulnerability Management ">Capacity Enhancement Guide on Remote Patch and Vulnerability Management</a> to help agencies better manage their remote devices. </p> <h4 id="how-often-will-cisa-add-new-vulnerabilities-to-the-catalog">How often will CISA add new vulnerabilities to the catalog?</h4> <p>CISA adds new vulnerabilities to the catalog when our team identifies a vulnerability that meets the following conditions:</p> <ul> <li>Has an assigned Common Vulnerabilities and Exposures (CVE) ID.</li> <li>There is reliable evidence that the vulnerability has been actively exploited in the wild.</li> <li>There is a clear remediation action for the vulnerability, such as a vendor provided update.</li> </ul> <p>We expect that the number of Known Exploited Vulnerabilities will expand over time, because there is a significant increase in the number of new CVEs each year. This is due both to the increase in the number and capabilities of threat actors and the greater scrutiny being performed by security researchers.</p> <h4 id="whats-the-difference-between-a-high-or-critical-cve-and-a-known-exploited-vulnerability-kev">What’s the difference between a High or Critical CVE and a Known Exploited Vulnerability (KEV)?</h4> <p>CVEs are currently scored under the CVSS system, which does not take into consideration whether a vulnerability has ever been used to exploit a system in the wild. Many CVEs with high and critical CVSS scores are very complex, may require special conditions or permissions, and have only been demonstrated in labs. Known Exploited Vulnerabilities (KEVs) are a subset of CVEs which have been used to compromise systems in the real world.</p> <h4 id="arent-agencies-already-required-to-patch-against-all-cves-whats-the-point-of-creating-a-new-patching-requirement-should-my-organization-still-use-cvss-for-prioritization">Aren’t agencies already required to update all CVEs? What’s the point of creating a new updating requirement? Should my organization still use CVSS for prioritization?</h4> <p>Agencies are not required to update all CVE’s. To be effective, vulnerability management programs must take active threats into consideration. CISA encourages all stakeholders to leverage the CISA catalog of known exploited vulnerabilities and to prioritize these vulnerabilities for immediate remediation. CISA acknowledges CVSS scoring should still be a part of an organization’s vulnerability management efforts, especially with machine-to-machine communication and large-scale automation.</p> <h4 id="affected-assets-cannot-be-updated">When affected assets cannot be updated per vendor recommendations, are there alternative mitigation actions available?</h4> <p>Aside from removing affected assets from the network, the only known technical mitigation to these vulnerabilities is to apply the required actions listed in the catalog. If these actions cannot be accomplished within the required timeframe, you must remove the asset from the agency network. An asset that cannot be updated, is most likely a legacy unsupported asset with very high operational uptime requirements.</p> <p>Isolation is a form of removal from the network that minimizes direct access to critical software, critical software platforms, and associated data. Depending on your security and network architectures, this strategy can be highly effective at stopping threats against vulnerable devices. Organizations need to be prepared to implement isolation methods when needed and to undo the isolation after applying the necessary patch(es) in order to restore regular device access and functionality. Depending on your environment, appropriate isolation techniques may include decommissioning, removal of the vulnerable software product, network segmentation, isolation, software-defined perimeters, and proxies.</p> <h4 id="#KEV-not-yet-be-listed">Why might a KEV not yet be listed in the National Vulnerability Database (NVD)?</h4> <p>Sometimes third-party organizations release advisories about a CVE ID before details on that CVE are published in the CVE list. A CVE will not be available in the NVD if it has a status of reserved. You can check <a href="https://cve.mitre.org/cve/search_cve_list.html" title="Search CVE List">https://cve.mitre.org/cve/search_cve_list.html</a> to confirm whether the CVE is in “reserved” status.</p> <p>A CVE Record is marked as “reserved” when it has been reserved for use by a CVE Numbering Authority (CNA) or security researcher, but the details of it are not yet published by the CNA. Reserved is the initial state for a CVE Record.</p> <p>A CVE Record can change from the "reserved" state to being published at any time based on a number of factors both internal and external to the CVE List. Once the CVE Record is published with details on the CVE List, it will become available in the NVD. As one of the final steps in the process, the NVD Common Vulnerability Scoring System (CVSS) scores for the CVE Records are assigned by the NIST NVD team (<a href="https://www.cve.org/ResourcesSupport/FAQs" title="Resources Support">https://www.cve.org/ResourcesSupport/FAQs</a>).</p> <h4 id="#leverage-CISA-provided-tools">How do we leverage CISA provided tools to help find CVEs in the KEV Catalog?</h4> <p>In December 2021, CDM released specialized visualizations and dashboards that clearly identify known exploited vulnerabilities to federal agencies. This is provided by having the CDM dashboard enrich agency vulnerability reporting using the KEV/BOD feed that CISA maintains. This ensures that when new KEVs are updated in the CISA repository, that it is automatically provided to the CDM platform and can be tagged within the CDM reporting process without any manual intervention of the end user. CDM had previously implemented a “heightened” vulnerability flag for scenarios such as this called the “Federal Vulnerability Action” (FVA), going forward this flag is exclusively used to mirror the KEVs to ensure functionality parity going forward.</p> <p>These features are available to any agency that has an operational CDM Agency Dashboard that is being fed vulnerability information from CDM tools and sensors. For more detailed information please reach out to your CDM portfolio team.</p> <p>The CISA Cyber Hygiene (CyHy) team is currently working on adding the capability to highlight KEVs in the weekly Vulnerability Scanning reports as well as to send out ad-hoc alerts within 24 hours of a KEV being newly detected on an agency asset. Please keep in mind that CyHy VS is only able to detect vulnerabilities from outside your network, so CVEs that require internal access or credentials to detect will not be found in your CyHy VS reports, even if that CVE may exist on your network.</p> <h4 id="CISA-approve-a-waiver">Will CISA approve a waiver if our agency faces severe difficulty implementing a specific patch?</h4> <p>CISA does not issue waivers or exceptions for actions required in cyber directives. Please let CISA (<a href="mailto:cyberdirectives@cisa.dhs.gov" title="Email CyberDirectives">CyberDirectives@cisa.dhs.gov</a>) know any special use cases as soon as possible so that we can work with your agency to understand the challenge, the options for mitigation, and estimated remediation timeframe.</p> <h4 id="will-CISA-encourage-Cloud-Service-Providers">How will CISA encourage Cloud Service Providers (CSPs) to commit to doing their part to patch these KEVs? How should agencies report vulnerabilities in federal information systems hosted in third-party environments (such as the Cloud)?</h4> <p>CISA is working closely with FedRAMP to coordinate the response to this Directive with FedRAMP Authorized cloud service providers (CSPs). FedRAMP Authorized CSPs have been informed to coordinate with their agency customers. CISA is also aware of third parties providing services for federal information systems subject to this Directive that may not be covered by a FedRAMP authorization.</p> <p>Each agency is responsible for inventorying all their information systems hosted in third-party environments (FedRAMP Authorized or otherwise) and contacting service providers directly for status updates pertaining to, and to ensure compliance with, this Directive.</p> <p>If instances of affected versions have been found in a third-party environment, reporting and remediation obligations will vary based on the type of the service provided and whether the provider is another federal agency or a commercial provider.</p> <p>For reporting purposes:</p> <ul> <li>If the affected third-party service provider is another federal entity, the agency providing the service is responsible for submitting status reports under this Directive to CISA. The agency receiving the service may not have any further reporting obligation for that specific system.</li> <li>If the affected third-party service provider is a commercial provider (FedRAMP Authorized or otherwise), the service provider must report the status of outstanding vulnerabilities to the agency receiving the service. The agency receiving the service is then responsible for any reporting required by this Directive. Agencies remain responsible for engaging their service providers directly, as needed, to ensure compliance with this Directive.</li> </ul> <h4 id="determine-active-exploitation">How did CISA determine Active Exploitation?</h4> <p>CISA primarily receives exploitation information directly from security vendors, researchers, and partners. CISA also obtains exploitation information through U.S. Government and international partners, via open-source research performed by CISA analysts, and through third-party subscription services.</p> <p>When informed of active exploitation directly by a security vendor, security researcher, or partner (including U.S. and international government agencies), CISA meets with the reporting entity to discuss the exploitation evidence. CISA adds the reported actively exploited vulnerabilities to the KEV catalog, provided they meet BOD 22-01 requirements. Exploited vulnerabilities CISA uncovers through incident response efforts are also added to the KEV catalog.</p> <p>CISA analysts perform daily open-source searches for vulnerabilities. Active exploitation information obtained from vendor security advisories are trusted sources and considered accurate. When cybersecurity news outlets, academic papers, cybersecurity company press releases (not from the affected vendor), etc., report active exploitation, CISA reviews wording and original source citations for the exploitation for accuracy and reliability. If the information is reliable, CISA adds the vulnerability to the KEV catalog; if CISA does not consider the information 100% accurate, CISA does not add the vulnerability to the KEV catalog (however, CISA internally notes the vulnerability and will add it to the catalog should further exploitation evidence come to light that justifies its inclusion). </p> <p>CISA also has purchased subscription services for threat intelligence platforms that contain information on vulnerabilities, including honeypot detection, malware observations in the wild, threat intelligence reports, etc. Similar to the open-source research procedures, CISA reviews the information from the platforms and adds the vulnerability to the KEV catalog, if the information is reliable. </p> <h4 id="update-the-kev">How quickly does CISA update the KEV catalog after a new in-scope vulnerability is identified?</h4> <p>CISA updates the KEV catalog within 24 hours of known exploitation evidence.</p> <h4 id="older-being-added">There is an older CVE being added to the KEV catalog. Is CISA seeing an active exploitation for it?</h4> <p>Addition of a vulnerability to the KEV catalog does not indicate that CISA is observing current active exploitation. If there is accurate reporting of active exploitation, any vulnerability, despite its age, can qualify for KEV catalog addition.</p> <h4 id="end-of-life-products">Why are old CVEs and/or end-of-life products being added to the KEV catalog?</h4> <p>CISA does not assume that all running legacy products are fully patched. CISA also does not assume that all end-of-life products have been decommissioned. </p> <p>The absence of evidence of exploitation currently occurring does not preclude a vulnerability from being exploited in the future. If an actor is targeting your network and you have a vulnerable legacy product, they may use that vulnerability to their advantage.</p> <h4 id="is-there-a-poc">Is there a PoC available? OR We don’t see a PoC for this vulnerability.</h4> <p>Although the percentage of listed vulnerabilities with PoCs may be high, an available PoC is not a requirement for addition to the KEV catalog. </p> <h4 id="third-party-product">A vulnerability in the KEV catalog has a specific vendor and product listed. However, this product is embedded into a third-party product provided by a different security vendor and they did not provide a patch. How should I proceed?</h4> <p>CISA provides the original vendor and product attached to a particular vulnerability along with the original vendor-provided patch. If your environment contains a third-party product from a different security vendor, you will need to contact that vendor directly to obtain the patch.</p> <h4 id="correct-product-to-patch">A plug-in and/or our research shows a different vendor/product for this CVE ID than what is listed on the KEV catalog. What is the correct product to patch?</h4> <p>CISA aims to publish the most up-to-date information available when adding a vulnerability to the KEV catalog; however, for some products, it is difficult to determine where the vulnerability resides. If multiple products are attributed to the same CVE ID, CISA recommends that, where applicable, users patch all associated products with that CVE ID.</p> <h4 id="remove-entries">Does CISA ever remove entries from the KEV catalog?</h4> <p>CISA will only remove a vulnerability if the vendor’s security update for that vulnerability causes a significant unforeseen issue with greater impact than the vulnerability itself. Once the vendor resolves the issue, the vulnerability will be restored to the catalog.</p> <h4 id="how-can-i-use-the-kev">How can I use the KEV catalog at my organization?</h4> <p>CISA recommends organizations use the KEV catalog in conjunction with a vulnerability scoring framework that evaluate exploitation status, such as the Stakeholder Specific Vulnerability Categorization (SSVC) model. Doing so will help inform decisions about prioritizing vulnerability management activities. Active exploitation of a vulnerability is a widely accepted risk factor and should be considered in vulnerability management activities. Organizations should also consider using automated vulnerability and patch management tools that automatically incorporate and flag or prioritize KEV vulnerabilities. Examples of such tools include <a href="/stopransomware/cyber-hygiene-services" title="Cyber Hygiene Services">CISA's cyber hygiene services</a>, Palo Alto Networks Cortex, Tenable Nesses, Runecast, Qualsys VMDR, Wiz, Rapid 7 InsightVM, and Rapid7 Nexpose. Organizations with additional tools that are incorporating KEV vulnerabilities can be added to this list by emailing <a class="mailto" href="mailto:CISA.JCDC@CISA.DHS.GOV" title="Email JCDC">CISA.JCDC@CISA.DHS.GOV</a>.</p> <p>The KEV catalog can play a role in your vulnerability management program but should not be the only factor. It can serve as a great starting point if you do not yet have a vulnerability management program in place. CISA strongly recommends organizations have updated asset inventory information to best determine the software and hardware products that are currently in your environment and to identify the KEV catalog vulnerabilities that directly affect your organization. </p> <h4 id="remove-entries">Why is the KEV missing a vulnerability I've seen exploitation for?</h4> <p>Reliable evidence of exploitation in the wild is only one of the criteria needed to add a vulnerability to the KEV. A vulnerability must also have a CVE ID and clear remediation guidance. As a reminder, the KEV is part of a risk-reduction action for federal civilian executive branch agencies as defined in BOD-22-01 (<a href="/news-events/directives/binding-operational-directive-22-01" title="BOD 22-01">Binding Operational Directive 22-01 | CISA</a>). This directive establishes a CISA-managed catalog of known exploited vulnerabilities that carry significant risk to the federal enterprise. Organizations or individuals with information about an exploited vulnerability not currently listed on the KEV are encouraged to contact us at <a href="mailto:vulnerability@cisa.dhs.gov?subject=Vulnerability%20for%20KEV%20Consideration">vulnerability@cisa.dhs.gov</a>.</p> <h4 id="remove-entries">What are the criteria for a vulnerability being added to the KEV?</h4> <p>As prescribed by BOD-22-01 (<a href="/news-events/directives/binding-operational-directive-22-01" title="BOD 22-01">Binding Operational Directive 22-01 | CISA</a>), the KEV is a list of vulnerabilities that federal executive civilian branch agencies are required to patch on an accelerated timeline. There are three criteria for adding a vulnerability to the KEV: (1) a CVE ID; (2) clear remediation guidance, and (3) reliable evidence of exploitation in the wild.</p> <h4 id="how-can-i-use-the-kev">Is the KEV the only list of vulnerabilities that I need to worry about?</h4> <p>No. The KEV catalog sends a clear message to all organizations to prioritize remediation efforts on the subset of vulnerabilities that are causing immediate harm based on adversary activity. However, we do not recommend exclusive use of the KEV catalog as the only criterion on which organizations triage vulnerabilities. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework. CISA recommends using vulnerability management frameworks such as the <a href="/stakeholder-specific-vulnerability-categorization-ssvc" title="Stakeholder-Specific Vulnerability Categorization (SSVC)">Stakeholder-Specific Vulnerability Categorization (SSVC)</a> to triage vulnerabilities using decision points appropriate to your organization. The state of exploitation is one such recommended decision point, and the KEV is an important source of relevant information.</p> <h3>Resources and Contact Information</h3> <ul> <li>General information, assistance, and reporting – <a class="mailto" href="mailto:cyberdirectives@cisa.dhs.gov" title="Email CyberDirectives">cyberdirectives@cisa.dhs.gov</a></li> <li><a href="/known-exploited-vulnerabilities-catalog" title="KEV Catalog">Click here for CISA managed catalog of known exploited vulnerabilities</a></li> <li><a href="https://public.govdelivery.com/accounts/USDHSCISA/subscriber/new?topic_id=USDHSCISA_136" title="KEV Email Updates">Click here to sign up for automatic alerts when new vulnerabilities are added to the catalog</a></li> </ul> </div> </div> </div> </div> <div class="l-page-section l-page-section--tags l-page-section--rich-text"> <div class="l-constrain"> <div class="l-page-section__content"> <h3>Tags</h3> <div class="c-field"> <strong>Topics</strong>: <a href="/topics/cybersecurity-best-practices">Cybersecurity Best Practices</a> </div> </div> </div> </div> </div> </div> <div class="l-sidebar__footer"> <div class="c-view c-view--detail-page-related-content c-view--display-block_3 view js-view-dom-id-4421dd010b6085b69bb243d5f0f09121c17bd30233cbbf3d736edf4a39ffd2dd c-collection c-collection--blue c-collection--two-column"> <div class="l-constrain"> <div class="c-collection__row"> <div class="c-collection__content"> <h2 class="c-collection__title"><span class="c-collection__title-wrap">Related Directives</span></h2> </div> <div class="c-collection__cards"> <article class="c-teaser c-teaser--horizontal" role="article"> <div class="c-teaser__row"> <div class="c-teaser__content"> <div class="c-teaser__eyebrow"> <div class="c-teaser__date"><time datetime="2023-06-13T12:00:00Z">Jun 13, 2023</time> </div> </div> <h3 class="c-teaser__title"> <a href="/news-events/directives/bod-23-02-implementation-guidance-mitigating-risk-internet-exposed-management-interfaces" target="_self"> <span>BOD 23-02: Implementation Guidance for Mitigating the Risk from Internet-Exposed Management Interfaces</span> </a> </h3> </div> </div> </article> <article class="c-teaser c-teaser--horizontal" role="article"> <div class="c-teaser__row"> <div class="c-teaser__content"> <div class="c-teaser__eyebrow"> <div class="c-teaser__date"><time datetime="2023-06-13T12:00:00Z">Jun 13, 2023</time> </div> </div> <h3 class="c-teaser__title"> <a href="/news-events/directives/binding-operational-directive-23-02" target="_self"> <span>BOD 23-02: Mitigating the Risk from Internet-Exposed Management Interfaces</span> </a> </h3> </div> </div> </article> <article class="c-teaser c-teaser--horizontal" role="article"> <div class="c-teaser__row"> <div class="c-teaser__content"> <div class="c-teaser__eyebrow"> <div class="c-teaser__date"><time datetime="2022-10-03T12:00:00Z">Oct 03, 2022</time> </div> </div> <h3 class="c-teaser__title"> <a href="/news-events/directives/bod-23-01-implementation-guidance-improving-asset-visibility-and-vulnerability-detection-federal" target="_self"> <span>BOD 23-01: Implementation Guidance for Improving Asset Visibility and Vulnerability Detection on Federal Networks</span> </a> </h3> </div> </div> </article> <article class="c-teaser c-teaser--horizontal" role="article"> <div class="c-teaser__row"> <div class="c-teaser__content"> <div class="c-teaser__eyebrow"> <div class="c-teaser__date"><time datetime="2022-10-03T12:00:00Z">Oct 03, 2022</time> </div> </div> <h3 class="c-teaser__title"> <a href="/news-events/directives/bod-23-01-improving-asset-visibility-and-vulnerability-detection-federal-networks" target="_self"> <span>BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks</span> </a> </h3> </div> </div> </article> </div> </div> </div> </div> </div> </div> </div> </main> <footer class="usa-footer usa-footer--slim" role="contentinfo"> <div class="usa-footer__return-to-top"> <div class="l-constrain"> <a href="#">Return to top</a> </div> </div> <div class="usa-footer__upper"> <div class="l-constrain"> <ul class="c-menu c-menu--footer-main"> <li class="c-menu__item"> <a href="/topics" class="c-menu__link js-top-level" aria-current="false" data-drupal-link-system-path="node/7329">Topics</a> </li> <li class="c-menu__item"> <a href="/spotlight" class="c-menu__link js-top-level" aria-current="false" data-drupal-link-system-path="node/7330">Spotlight</a> </li> <li class="c-menu__item"> <a href="/resources-tools" class="c-menu__link js-top-level" aria-current="false" data-drupal-link-system-path="node/7331">Resources & Tools</a> </li> <li class="c-menu__item is-active-trail"> <a href="/news-events" class="c-menu__link js-top-level is-active-trail" aria-current="false" data-drupal-link-system-path="node/7332">News & Events</a> </li> <li class="c-menu__item"> <a href="/careers" class="c-menu__link js-top-level" aria-current="false" data-drupal-link-system-path="node/7323">Careers</a> </li> <li class="c-menu__item"> <a href="/about" class="c-menu__link js-top-level" aria-current="false" data-drupal-link-system-path="node/6944">About</a> </li> </ul> </div> </div> <div class="usa-footer__main"> <div class="l-constrain"> <div class="usa-footer__main-row"> <div class="usa-footer__brand"> <a class="c-site-name c-site-name--footer" href="/" rel="home" title="Go to the Cybersecurity & Infrastructure Security Agency homepage"> <span class="c-site-name__text">Cybersecurity & Infrastructure Security Agency</span> </a> </div> <div class="usa-footer__contact"> <ul class="c-menu c-menu--social"> <li class="c-menu__item"> <a href="https://www.facebook.com/CISA" class="c-menu__link--facebook c-menu__link js-top-level" aria-current="false">Facebook</a> </li> <li class="c-menu__item"> <a href="https://twitter.com/CISAgov" class="c-menu__link--twitter c-menu__link js-top-level" aria-current="false">Twitter</a> </li> <li class="c-menu__item"> <a href="https://www.linkedin.com/company/cybersecurity-and-infrastructure-security-agency" class="c-menu__link--linkedin c-menu__link js-top-level" aria-current="false">LinkedIn</a> </li> <li class="c-menu__item"> <a href="https://www.youtube.com/@cisagov" class="c-menu__link--youtube c-menu__link js-top-level" aria-current="false">YouTube</a> </li> <li class="c-menu__item"> <a href="https://www.instagram.com/cisagov" class="c-menu__link--instagram c-menu__link js-top-level" aria-current="false">Instagram</a> </li> <li class="c-menu__item"> <a href="/subscribe-updates-cisa" class="c-menu__link--rss c-menu__link js-top-level" aria-current="false">RSS</a> </li> </ul> <div class="usa-footer__contact-info"> <span>CISA Central</span> <a href="tel:1-844-Say-CISA">1-844-Say-CISA</a> <a href="mailto:SayCISA@cisa.dhs.gov">SayCISA@cisa.dhs.gov</a> </div> </div> </div> </div> </div> <div class="usa-footer__lower"> <div class="l-constrain"> <div class="usa-footer__lower-row"> <div class="usa-footer__lower-left"> <div class="c-dhs-logo"> <div class="c-dhs-logo__seal">DHS Seal</div> <div class="c-dhs-logo__content"> <div class="c-dhs-logo__url">CISA.gov</div> <div class="c-dhs-logo__text">An official website of the U.S. Department of Homeland Security</div> </div> </div> <ul class="c-menu c-menu--footer"> <li class="c-menu__item"> <a href="/about" class="c-menu__link js-top-level" title="About CISA" aria-current="false" data-drupal-link-system-path="node/6944">About CISA</a> </li> <li class="c-menu__item"> <a href="https://www.dhs.gov/performance-financial-reports" class="c-menu__link js-top-level" title="Budget and Performance" aria-current="false">Budget and Performance</a> </li> <li class="c-menu__item"> <a href="https://www.dhs.gov" title="Department of Homeland Security" class="c-menu__link js-top-level" aria-current="false">DHS.gov</a> </li> <li class="c-menu__item"> <a href="/oedia" title="Equal Opportunity & Accessibility" class="c-menu__link js-top-level" aria-current="false" data-drupal-link-system-path="node/21462">Equal Opportunity & Accessibility</a> </li> <li class="c-menu__item"> <a href="https://www.dhs.gov/foia" class="c-menu__link js-top-level" title="FOIA Requests" aria-current="false">FOIA Requests</a> </li> <li class="c-menu__item"> <a href="/no-fear-act" title="No FEAR Act Reporting" class="c-menu__link js-top-level" aria-current="false" data-drupal-link-system-path="node/21494">No FEAR Act</a> </li> <li class="c-menu__item"> <a href="https://www.oig.dhs.gov/" class="c-menu__link js-top-level" title="Office of Inspector General" aria-current="false">Office of Inspector General</a> </li> <li class="c-menu__item"> <a href="/privacy-policy" class="c-menu__link js-top-level" title="Privacy Policy" aria-current="false" data-drupal-link-system-path="node/16115">Privacy Policy</a> </li> <li class="c-menu__item"> <a href="https://public.govdelivery.com/accounts/USDHSCISA/subscriber/new?topic_id=USDHSCISA_138" title="Subscribe to Email Updates" class="c-menu__link js-top-level" aria-current="false">Subscribe</a> </li> <li class="c-menu__item"> <a href="https://www.whitehouse.gov/" class="c-menu__link js-top-level" title="The White House" aria-current="false">The White House</a> </li> <li class="c-menu__item"> <a href="https://www.usa.gov/" class="c-menu__link js-top-level" title="USA.gov" aria-current="false">USA.gov</a> </li> <li class="c-menu__item"> <a href="/forms/feedback" title="Website Feedback" class="c-menu__link js-top-level" aria-current="false" data-drupal-link-system-path="forms/feedback">Website Feedback</a> </li> </ul> </div> <div class="usa-footer__lower-right"> <iframe src="https://www.dhs.gov/ntas/" name="National Terrorism Advisory System" title="National Terrorism Advisory System" width="170" height="180" scrolling="no" frameborder="0" seamless border="0" ></iframe> </div> </div> </div> </div> </footer> </div> </div> <script src="/profiles/cisad8_gov/themes/custom/gesso/dist/js/common.js?snj5wy"></script> <script src="/profiles/cisad8_gov/themes/custom/gesso/dist/js/uswds-init.es6.js?snj5wy"></script> <script src="/profiles/cisad8_gov/themes/custom/gesso/dist/js/uswds.es6.js?snj5wy"></script> <script src="https://dap.digitalgov.gov/Universal-Federated-Analytics-Min.js?agency=DHS&subagency=CISA&yt=true" id="_fed_an_ua_tag"></script> <script src="/modules/contrib/extlink/js/extlink.js?v=10.3.6"></script> <script src="/modules/contrib/ckeditor_accordion/js/accordion.frontend.min.js?snj5wy"></script> <script src="/profiles/cisad8_gov/themes/custom/gesso/dist/js/teaser.es6.js?snj5wy"></script> <script src="/profiles/cisad8_gov/themes/custom/gesso/dist/js/menu-sidebar.es6.js?snj5wy"></script> </body> </html>