Patch what attackers use: BOD 22-01 and the agency work queue

The week

On November 3, 2021, the Cybersecurity and Infrastructure Security Agency issued Binding Operational Directive 22-01, Reducing the Significant Risk of Known Exploited Vulnerabilities. The directive created a public catalog of vulnerabilities that CISA had evidence were being actively exploited. Federal civilian executive branch agencies had to remediate catalog entries on set timelines: two weeks for vulnerabilities assigned identifiers in 2021 or later, and six months for older ones, unless CISA set a different date. Agencies also had to review and update their vulnerability management procedures within 60 days and report on their status. The directive bound only federal civilian agencies, but CISA encouraged state and local governments and private organizations to use the catalog to set their own priorities.

Vulnerability management had long run on severity scores. A scanner reports thousands of findings, each with a score, and the team works down from the top. A high score describes how bad a flaw could be, not whether anyone is using it. Most high-severity vulnerabilities are never exploited in the wild, while some that are exploited carry middling scores. BOD 22-01 replaced the ranking with a smaller, evidence-based list and a clock. For agency IT operations, that was less a change in security theory than a change in how people spend their week. We look at three parts: the work queue, the conversation with system owners, and the work the directive left untouched.

The work queue

Before the directive, a typical agency patch team faced a backlog it could never clear and a ranking that did not separate urgent from merely serious. Afterward, a defined subset of findings carried a federal deadline. That gave the team a short list it could actually finish, and a reason to finish it that did not depend on internal argument. Completion rates became meaningful again, because the denominator was a few hundred catalog entries rather than tens of thousands of findings.

The catalog was also continuous. CISA added entries as it confirmed exploitation, each with its own due date, sometimes several in a week. That turned vulnerability management from a monthly cycle into something closer to an operational feed. Teams needed to see each addition, match it to their assets and assign an owner within a day or two. Agencies with accurate asset data could do that in hours. Agencies without it learned that the directive was really a test of inventory. A catalog entry for a particular VPN appliance or content management system is useless if nobody knows where those products run.

The practical changes were mundane and effective. Teams subscribed to the catalog’s machine-readable feed and pulled it into their scanners and ticketing systems. They tagged assets with product and version so a new entry produced a list of affected systems automatically. They set internal deadlines a few days ahead of CISA’s, leaving room for testing failures. And they started measuring time to remediate catalog entries, which is a more honest metric than total findings closed.

The conversation with system owners

The hardest part of patching is rarely the patch. It is scheduling downtime, testing compatibility and persuading a program office that the risk justifies the disruption. A severity score invites debate. A federal directive with a deadline, tied to evidence that attackers are using the flaw, mostly ends it. Patch teams gained a clear basis for asking mission owners to accept maintenance windows, and chief information officers gained a reason to back them.

The directive also surfaced systems that could not be fixed on schedule. These included end-of-life platforms, vendor-managed appliances where the agency had no administrative access, and products whose vendors had not shipped a fix. Each needed a documented decision: isolate the system, apply a workaround, accept the risk at an appropriate level, or accelerate replacement. That pushed some long-deferred modernization choices onto the calendar. It also exposed contracts that gave vendors control of patch timing without any obligation to meet a federal deadline. New contracts began to include remediation windows for exploited vulnerabilities.

Reporting created its own discipline. Agencies had to show status against the catalog, so the data had to hold up. A patch marked as deployed on a system later found unpatched is worse than an honest exception. Teams that verified remediation by rescanning, rather than trusting the deployment tool’s status, produced reports that survived scrutiny and spent less time reconciling numbers by hand. The trade-off was capacity: rescanning and exception handling took staff time that had to come from somewhere.

The work the directive left untouched

The directive did not shrink the overall backlog, and it did not remove the need to manage it. A catalog of known exploited vulnerabilities is backward-looking by design. A flaw is added after exploitation is observed, so attackers using new or obscure vulnerabilities will not appear on it in time. Agencies still needed exposure management for internet-facing systems, hardening, and detection for what patching cannot prevent. Some teams found that the catalog crowded out this quieter work, because deadline-driven tasks always win the week.

It also did not add people. The same administrators handled the new deadlines alongside existing work. Agencies already struggling to recruit and keep systems staff found that a fast clock on a short list was easier to meet than a slow clock on everything, but it was still more work. The agencies that coped best used the directive to justify two investments: accurate asset inventory and automated patch deployment for standard platforms. Those freed skilled staff for the awkward cases, such as legacy systems and appliances, where judgment is required.

Outside the federal civilian government, the catalog was public and free. State and local agencies, health systems and banks could use it as a prioritization input without adopting federal deadlines. For organizations without a threat intelligence function, it answered the question of which vulnerabilities matter now. For those with one, it served as a cross-check that was easy to explain to auditors and boards.

With hindsight

The catalog grew steadily and became one of the most widely referenced public sources in vulnerability management. Scanner and ticketing vendors built it into their products, insurers and auditors began asking about it, and many states adopted it as a benchmark for their own agencies. It was later complemented by probability-based scoring, such as the Exploit Prediction Scoring System, which estimates the likelihood of exploitation for flaws not yet listed. The limits visible in 2021 also held. Attackers increasingly targeted edge devices such as VPNs and firewalls, sometimes exploiting flaws before any fix existed, so a remediation deadline could not by itself prevent compromise. By this point in 2026, the lasting contribution of BOD 22-01 is a habit: prioritize by evidence of exploitation, keep inventory accurate, and measure time to fix rather than findings closed.