By BOD 26-04 Compliance for Program Offices: A Remediation Roadmap
BOD 26-04, BOD 26-02 and FedRAMP's new vulnerability rules turned remediation into a set of dated obligations. This roadmap lays out the deadlines, the controls that evidence compliance, what the Authorizing Official still decides, and the SOW terms that keep a remediation effort on schedule.
For years, a vulnerability backlog was a management problem. In 2026 it became a set of dated obligations. CISA issued two binding directives that change how civilian agencies remediate, FedRAMP set a date for new vulnerability rules, and DoD continued to score remediation discipline in its readiness inspections. A program office now needs to show not just that it patches, but that each finding was fixed on the right clock, with evidence.
This roadmap is for the ISSM, ISSO or program manager who has to plan that work and defend it to an Authorizing Official, a CISO or an Inspector General.
The Deadlines
| Requirement | What it sets | Key dates |
|---|---|---|
| BOD 26-04, Prioritizing Security Updates Based on Risk | Remediation clocks from four inputs: exposure, KEV status, automatable exploitation and technical impact. Three days with forensic triage at the top; then 14 days, 60 days or the next upgrade. Replaced BOD 22-01 and BOD 19-02 | Issued June 10, 2026. Policy updates immediately, process updates within 60 days, full timelines within about 180 days |
| BOD 26-02, Mitigating Risk from End-of-Support Edge Devices | Inventory, decommissioning and replacement of end-of-support routers, firewalls and similar devices | Issued February 6, 2026. Inventory within 3 months; decommission pre-existing end-of-support devices within 12; replace all within 18; continuous discovery within 24 |
| FedRAMP Consolidated Rules | New vulnerability detection and response, and evaluation and reporting rules for cloud providers | Adoption deadline December 7, 2026; rules mandatory January 1, 2027 |
Both directives bind federal civilian agencies, not national security systems. DoD components track BOD 26-04 as practice, and the Cyber Operational Readiness Assessment scores STIG compliance and remediation discipline directly, so the same roadmap applies with different inspectors.
The Controls That Evidence Compliance
A remediation program produces evidence for a defined set of NIST SP 800-53 Rev. 5 controls. Each should have an owner and a current artifact.
| Control | What the program office should be able to show |
|---|---|
| SI-2 Flaw remediation | Findings closed within defined timeframes, with test and deployment records |
| RA-5 Vulnerability monitoring and scanning | Validation rescans with the same scanner and policy as the baseline |
| CM-6 Configuration settings | STIG or CIS remediation with SCAP results |
| SI-5 Security alerts, advisories and directives | Intake of new KEV entries and directives, with clock assignments |
| CM-3 Configuration change control | Change-board approvals for each remediation wave |
| CM-8 System component inventory | Asset and owner mapping that matches what the scanner sees |
| CA-5 Plan of action and milestones | POA&M items with owners, resources, dates and closure evidence |
The organization-defined parameters in SI-2 and RA-5, such as remediation timeframes and scan frequency, should now reflect the BOD 26-04 clocks for civilian systems. An assessor will check the parameter values against the directive, and a policy that still cites a single 15- or 30-day window is out of date. NIST SP 800-40 Rev. 4 (opens in a new tab) remains the reference for structuring the underlying patch management program.
What Stays With the Government
Three decisions belong to the agency, and the roadmap should name who makes each:
- Residual risk. When a finding cannot be patched, the compensating control and the remaining risk go to the Authorizing Official in a written memo. Accepting that risk is the AO's decision, not the remediation team's.
- Maintenance windows and change approval. The change advisory board controls the pace of remediation more than any engineering factor. A program that cannot get windows cannot meet clocks, and that dependency belongs in the plan.
- Incident escalation. When forensic triage on a top-tier finding suggests prior compromise, the decision to open a formal incident response belongs to the agency's security operations and leadership.
The approved language for any proposal or status brief follows from this. A remediation effort "closes identified findings within directive timelines for the tiers in scope and produces assessor-ready closure evidence." It does not "achieve compliance," "deliver an ATO" or "guarantee a clean inspection," because some findings are always unpatchable and those outcomes belong to an official or an inspection team.
Closure Evidence an Assessor Accepts
The POA&M is where remediation becomes visible to an AO. Every closed item needs evidence that would survive review: before-and-after scan results from the baseline scanner, configuration diffs where relevant, the change record, and a recommended POA&M update. Items that cannot be closed need a residual-risk memo instead of silence.
The evidence is organized by control and finding in the agency's system of record, such as eMASS, CSAM or ServiceNow, rather than delivered as one large report. Packages built that way move faster through assessment, which is the same principle behind ATO packages assessors can verify (opens in a new tab).
Contractor Environments
Defense contractors face the same work under different rules. NIST SP 800-171 requirement 3.14.1 calls for identifying, reporting and correcting flaws in a timely manner, supported by 3.11.2 and 3.11.3 on scanning and remediating vulnerabilities. DoD suspended CMMC Phase 2 third-party certification on July 13, 2026 (opens in a new tab) pending a review, but Phase 1 self-assessment and the underlying 800-171 obligations remain. The evidence a contractor needs for its self-assessment is the same evidence described above.
SOW Terms That Hold the Schedule
A remediation SOW protects the schedule by making dependencies explicit:
- Frozen baseline. A named scan export and date defines scope. New findings route to a pre-priced emergency lane for top-tier items, or to a change order.
- Named enclaves. Each system boundary is listed; additions are priced.
- Agency obligations with dates. Privileged access, change-board slots, committed maintenance windows, a test environment and timely approvals, each with an owner and due date.
- Delay log. An agency-attributable delay log in every status report from day one, tied to schedule relief.
- Same scanner and policy. For baseline and validation, in writing.
- Evidence format sampled early. Later changes are a change order.
- Explicit exclusions. Discovery scanning, POA&M ownership, full incident response, new platform deployment, custom application code and specialty device fleets.
- Firm fixed price for a sprint against the frozen baseline; a monthly price against an asset population band for managed operations.
Sequencing the Work
A practical order for a civilian program office is: update the vulnerability-management policy to the BOD 26-04 clocks if that has not happened; inventory edge devices against BOD 26-02; normalize the backlog and assign clocks; then burn it down in tested waves, starting with the highest tiers. Once the backlog is clear, a monthly cycle keeps it that way: intake of new KEV entries and vendor releases, the same test ring and change-board process, validation scans and a monthly metrics report showing clock compliance by tier. Without that cycle, a cleared backlog starts rebuilding with the next month's vendor releases and KEV additions. Validated findings from an independent assessment make the clock assignments defensible, and the cost of testing to that standard (opens in a new tab) is small next to the cost of fixing the wrong things first.
Avalon's Remediation & Patch Management service is the execution layer for this roadmap. It produces the normalized, clock-tagged backlog, closes findings in tested waves through your change board, documents residual risk for your AO, and delivers closure evidence for SI-2, RA-5, CM-6 and your POA&M.
