CISA Directs Federal Agencies to Prioritize Security Patches Based on Risk

CISA has issued a new directive requiring federal agencies to prioritize patching security vulnerabilities based on risk level rather than using traditional severity scores. The directive builds on CISA's Known Exploited Vulnerabilities catalog and sets aggressive timelines for remediation, with the most critical flaws in publicly exposed systems requiring patches within just three days if they can be automated by attackers. Federal agencies must also update their vulnerability management policies, automate reporting, and inventory their externally-accessible assets to support more effective network defense.