By The Remediation Gap Is a Line Item, Not a Backlog
Agencies have paid for years to find vulnerabilities and far less to fix them. CISA's BOD 26-04 now puts a three-day clock on the worst findings. Here is what closing a backlog actually costs, using an illustrative fixed-price sprint, and what slows it down.
Most federal agencies can say exactly how many vulnerabilities are open on their networks. Twenty years of spending on scanners, dashboards and enterprise licenses made sure of that. Far fewer can say when those findings will be closed, because the labor to close them was never funded at the same rate. The gap shows up as a growing POA&M, repeat Inspector General findings and ATO renewals conditioned on aging items.
In June 2026 the gap got a deadline. CISA's Binding Operational Directive 26-04 (opens in a new tab) replaced the flat KEV timeline for civilian agencies with risk-based clocks. A KEV-listed flaw that gives an attacker total control must be fixed within three days, with forensic triage to check for prior compromise. Others get 14 days, 60 days or the next system upgrade. Full timelines apply within about 180 days of issuance, which lands around December 2026.
A backlog with a clock on it is a budget item. The question for a CFO or COO is what it costs to close one, and what makes it cost more.
What a Sprint Costs
The figures below are a planning illustration for one system boundary, not a quote and not a result from any engagement.
| Input | Value |
|---|---|
| Raw findings across scans, a pen test and open POA&M items | 1,200 rows |
| Duplicates (same flaw, same asset, reported more than once) | 60% |
| Deduplicated backlog | 480 findings |
| Closure rate once waves start in week 4 | About 60 a week |
| Findings that cannot be patched and need compensating controls | 10% |
| Fixed price | $75K |
The backlog clears in week 12, and evidence packaging finishes in week 13 of a 14-week plan. Forty-seven findings leave as documented compensating controls with a residual-risk memo for the Authorizing Official. The fixed price works out to about $156 per finding closed.
The deduplication line deserves attention on its own. Most agencies count the same flaw three ways in three tools, and normalizing the backlog often changes the conversation about how big the problem is before a single patch is applied.
What Makes It Cost More
The illustration is most sensitive to one input that has nothing to do with engineering: maintenance windows.
| Scenario | Backlog cleared | Sprint finish |
|---|---|---|
| Base case (60 closures a week) | Week 12 | Week 13 |
| Slow change board (35 closures a week) | Week 18 | Week 19 |
| 25% of findings unpatchable | Week 13 | Week 14 |
When the change board grants few windows, the same backlog takes six weeks longer, and a fixed-price engagement has to price that risk in. Committed maintenance windows are worth more than extra engineers. Unpatchable systems, by contrast, add effort but not failure: at 25%, the sprint still finishes on plan, with 118 findings left as documented residual risk rather than fixed.
Sprint or Monthly Operation
A sprint burns down an existing backlog. It does not stop the backlog from growing back. New KEV entries, monthly vendor releases and end-of-life events keep adding findings. That is the case for a managed patch operation, which runs the same tested cycle every month.
| Option | Market-norm range |
|---|---|
| Entry sprint, one boundary, up to about 500 findings | $45K–$95K |
| Standard sprint, multi-system, up to about 5,000 findings | $100K–$275K |
| Managed operation, light | $12K–$25K a month |
| Managed operation, standard, with an emergency lane | $25K–$60K a month |
The usual sequence is a sprint to clear the backlog, then a managed operation sized to the asset population, with a re-price trigger if that population moves outside an agreed band.
What the Line Item Avoids
The cost of not funding remediation rarely shows up in one place. It appears as a repeat IG finding, an ATO renewal conditioned on POA&M items, a failed DoD readiness inspection, or emergency incident response after a known vulnerability is exploited. BOD 26-04 adds a compliance dimension for civilian agencies, and BOD 26-02 (opens in a new tab) adds hard 12- and 18-month deadlines to retire end-of-support edge devices that cannot be patched at all.
None of those costs is in the remediation budget, which is why they are easy to underweight. They are also the reason a fixed-price sprint with a defined exit is an easier decision than it looks. Knowing which findings an assessor will expect evidence for (opens in a new tab) helps size the first sprint.
Fitting It Into This Year's Money
Remediation is O&M work, and an entry sprint fits under the $350,000 simplified acquisition threshold (opens in a new tab), so it can be bought as an open-market purchase with one-year funds. The fixed price is set against a frozen baseline, a named scan export and date, so the number approved is the number paid. New top-tier findings that arrive mid-sprint go to a pre-priced emergency lane rather than a surprise bill.
The engineering behind a tested remediation wave (opens in a new tab) explains what the price buys in practice: test rings, change-board packages, rollback plans and closure evidence.
Avalon's Remediation & Patch Management service starts with a fixed-price entry sprint for one system boundary. It turns your scan data into a deduplicated, clock-tagged backlog, closes it in tested waves, and hands your ISSO proof that each fix worked.
