From Directive to Deadline: Operating BOD 26-04 in the Real World
BOD 26-04 changes how federal agencies and FedRAMP providers handle vulnerabilities. It moves away from severity-based, 30-day patching and toward risk-based prioritization. In this webinar, Bob Costello (former CIO of CISA, strategic advisor to Nucleus Security, and Chief Digital and Information Officer at The Merlin Group) and Scott Kuffer (Co-founder and CPO at Nucleus Security) explain what the directive requires, why CISA built it on the SSVC decision-tree framework, and how to put it into practice.
The first half covers the policy: the four prioritization factors (asset exposure, known exploitation, automatable exploits, and technical impact), the December 7, 2026 deadline, what happens if you're not compliant, the forensic triage requirement, and whether CVSS scores still matter.
In the second half, Bob plays the role of a practitioner and puts real BOD 26-04 questions to Scott. Scott shows how to find internet-exposed assets with KEVs, automate BOD tiering and due dates, report on operational readiness, and enrich findings with vulnerability intelligence. The session ends with a look at how AI is changing vulnerability management and what directives may come next.
Whether you're in a federal agency, a FedRAMP environment, the defense industrial base, or the private sector, you'll leave with practical ideas for operationalizing risk-based vulnerability management.
Key Moments
00:00 Welcome and session goals
01:21 Meet the speakers
02:53 What is BOD 26-04, and why does it matter?
04:47 Why move away from severity-based, 30-day patching?
06:28 Why CISA chose SSVC over quantified risk scoring
09:25 Decision trees vs. score cutoffs, and chained vulnerabilities
11:10 The December 7 deadline and continuous asset tagging
12:56 What happens if you're not compliant: CAPs and FedRAMP impact
16:38 Handling the forensic evidence and triage requirement
20:48 Will CVSS scores still matter?
24:31 Practitioner Q&A: Putting BOD 26-04 into practice
25:37 What Nucleus Security does
27:10 Finding internet-exposed assets with KEVs
28:10 Automating the four-factor prioritization model
31:01 Reporting: Operational readiness and forensic triage queue
33:07 Vulnerability intelligence and enrichment
35:16 Past-due findings, SLA performance, and risk baselines
37:05 Applying BOD 26-04 outside the federal government
38:11 Scoping with asset tags: External critical assets
40:21 Work lists, software inventory, and investigating new CVEs
44:09 How AI is changing vulnerability management
50:25 Implementation resources
51:54 Audience Q&A: Will another BOD follow 26-04?
Learn more about Nucleus Security and BOD 26-04: https://nucleussec.com/bod-26-04/