CISA BOD 26-04: What CSPs and Contractors Must Do, and How Agencies Hold Them to It (Part 2)
Agencies own the risk, but providers own the fix. Here is the prescriptive playbook for cloud service providers and federal contractors under BOD 26-04, and the evidence agencies should demand.
InfusionPoints Blog
CISA BOD 26-04 makes agencies accountable for vulnerabilities in third-party and FedRAMP systems they use. Learn exactly what cloud service providers and contractors must deliver, on what timelines, and how agencies can verify it.
CISA BOD 26-04, Prioritizing Security Updates Based on Risk, has put Federal Civilian Executive Branch agencies on risk-based remediation timelines as short as 3 calendar days. But the directive's reach does not stop at the agency boundary.
Agencies remain accountable for the third-party systems, cloud services, and contractor-operated environments that process federal information, and FedRAMP has already answered with Notice NTC-0014: cloud service providers must adopt the new Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) rules by December 7, 2026. Legacy monthly scanning is officially insufficient.
If you are a CSP or a contractor operating systems on behalf of an agency, BOD 26-04 is now your operating model too. Here is what that means in practice.
Five things every cloud service provider and contractor must do
Adopt the VDR and VER rules before December 7, 2026. FedRAMP has confirmed with CISA that providers following the VDR and VER rules will meet or exceed BOD 26-04's expectations. That makes the path unambiguous: transition from monthly scan and POA&M cycles to continuous, automated vulnerability detection covering the full offering, not just CVEs. Rev. 5 providers are not exempt; an update to mandatory continuous monitoring is required to keep your certification.
Operate to Table 1 timelines, not your own SLA. Your agency customers must now remediate based on KEV status, public exposure, automatability, and technical impact, with windows as short as 3 calendar days. Your internal remediation SLAs must map to those same four factors and those same windows. Build the decision logic into your vulnerability management tooling so every finding is automatically classified against the Table 1 model, and be ready to show the classification, not just the fix.
Maintain exposure-aware asset inventory. Prioritization under BOD 26-04 is impossible without knowing which assets are internet reachable. CSPs must continuously identify externally reachable components of the authorization boundary, identify them with current context, and surface that exposure data to agency customers.
Build a forensic triage capability. Patching does not evict a threat actor who got in before the patch. For the highest-risk findings, including KEVs, exposed assets, and total-control impact vulnerabilities, agencies must perform forensic triage, and they cannot do it inside your boundary without you. Providers need documented procedures to scope affected systems, preserve evidence, stabilize and patch, contain exposure, analyze for prior compromise, and escalate to the agency and CISA when indicators are found.
Report continuously, in machine-readable form. The VER rules exist so agencies can consume your vulnerability posture as data. CSPs must deliver current remediation status, mitigation evidence, exposure context, and exploitability evaluations in a format agencies can feed into their own oversight.
The provider conversation has changed. “We scan monthly and track POA&Ms” is no longer an acceptable answer. Agencies will ask: “Which of your assets in my boundary are exposed? Which findings are in the KEV? What did you fix in 3 days, what did you mitigate, and can you prove it?” Providers who cannot answer will lose the assurance conversation, and eventually the authorization.
Mapping CISA BOD 26-04 to provider obligations
The directive's requirements land on agencies, but each one implies a concrete deliverable from the CSPs and contractors in the boundary. Use this mapping to structure contract language, continuous monitoring meetings, and evidence requests.
| BOD 26-04 Requirement | CSP / Contractor Obligation | Evidence Agencies Should Demand |
|---|---|---|
| Risk-based remediation timelines | Classify every finding against KEV, exposure, automatability, and impact; remediate or mitigate within the matching window. | Per-finding classification rationale and timestamps from detection to closure. |
| Continuous identification of internet-reachable assets | Maintain exposure inventory of the authorization boundary; report changes as they occur. | Current asset and exposure inventory, with drift history. |
| KEV catalog monitoring | Automated KEV matching against all components, including third-party and OSS dependencies. | KEV match alerts and time-to-detection metrics. |
| Forensic triage for highest-risk findings | Documented triage procedures: scope, preserve, stabilize, contain, analyze, escalate. | Triage runbooks, exercise records, and completed triage reports. |
| Mitigation as an alternative to remediation | Apply mitigations that remove automatability or internet reachability when a fix is not yet available. | Mitigation description and validation showing the risk factor was removed. |
| Reporting and automation | Machine-readable VER-format reporting on a continuous basis. | Automated report feeds and FedRAMP VDR/VER adoption status. |
What agencies must do to enforce this
Accountability without verification is just hope. To ensure providers and contractors are actually meeting BOD 26-04, agencies should:
- Validate boundary inventory. Confirm the provider's asset and exposure inventory against your own understanding of the FedRAMP boundary, including interconnections and managed services.
- Obtain directive status updates. Require providers to report BOD 26-04 alignment status, including VDR/VER adoption progress, ahead of the December 7, 2026 deadline.
- Make continuous monitoring collaborative. Shift from receiving monthly deliverables to jointly reviewing live vulnerability, exposure, and remediation data with the provider.
How InfusionPoints can help
InfusionPoints works both sides of the shared responsibility line. Through the Continuous Trust Platform (CTP), a coordinated loop of Build, Operate, Prove, and Defend, we help CSPs and contractors build VDR-ready environments where exposure tagging and continuous detection are part of the architecture, operate vulnerability response as a lifecycle aligned to the Table 1 timelines, prove posture with machine-readable evidence that satisfies VER reporting and agency oversight, and defend the boundary by connecting the highest-risk findings to monitoring, forensic triage, and escalation through our VNSOC360 security operations.
For agencies, we translate that same model into provider oversight: inventory validation, evidence requirements, and continuous monitoring that stands up to authorizing officials, all ahead of the December 2026 deadline.
Ready to meet CISA BOD 26-04 as a provider or enforce it as an agency? Talk to InfusionPoints about a BOD 26-04 and FedRAMP VDR readiness assessment and how Continuous Trust can support your mission. We are your experts.
References
Ready to make BOD 26-04 operational?
InfusionPoints helps agencies, CSPs, and contractors move from static reporting to continuous vulnerability awareness, evidence, and response.