Story perspectives

CISA Sets 72-Hour Rule for Critical Cyber Flaws

6/12/2026

Summary

CISA Issues Rule

CISA issued BOD 26-04 on June 10, imposing a 72-hour deadline and a rule that triggers when a flaw meets three of four criteria—public-internet exposure, known-exploited status, automated attack path, or attacker control, requiring agencies to verify prior compromise if four apply.
It replaces a 15-day guidance, gives agencies 60 days to revise and 180 days to adopt, permits vendors to market tools for flagging, automating remediation, and patchless mitigation.

Summary

CISA Sets Deadline

CISA will require agencies to tag internet-accessible devices and report remediation status on the Continuous Diagnostics and Mitigation (CDM) dashboard by Aug. 9, 2026.
Federal agencies say limited cybersecurity staff and incomplete asset visibility will hinder the three-day window.
Chris Butera said CISA believes agencies can meet the deadline because it exceeds 24 hours.
Patrick Garrity noted the directive mirrors guidance in India and the United Kingdom, indicating growing global momentum.

Summary

CISA Demands Fix

CISA issued a directive giving agencies three days to remediate critical vulnerabilities exploited by AI models such as Anthropic’s Mythos.
Acting Executive Assistant Director for Cybersecurity Chris Butera warned defenders cannot afford weeks to patch systems that can be autonomously exploited en masse.
The order’s appendix grants up to two weeks for less severe flaws and up to two months for the least serious category.

History

Historical Context

President Barack Obama signed Executive Order 13636 on 12 February 2013, directing federal agencies to improve critical-infrastructure cybersecurity. That mandate established a baseline for agency cybersecurity efforts, a practice that continues to shape federal cybersecurity policy. By contrast, Executive Order 14173, signed on 21 January 2025, revoked earlier civil-rights contracting requirements, showing how executive directives can shift policy focus.

1 of 4

CISA Issues Rule

CISA issued BOD 26-04 on June 10, imposing a 72-hour deadline and a rule that triggers when a flaw meets three of four criteria—public-internet exposure, known-exploited status, automated attack path, or attacker control, requiring agencies to verify prior compromise if four apply.
It replaces a 15-day guidance, gives agencies 60 days to revise and 180 days to adopt, permits vendors to market tools for flagging, automating remediation, and patchless mitigation.

1 / 4