The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued this year’s first binding operational directive (BOD) that ordered federal civilian agencies to address hundreds of exploited security vulnerabilities. CISA has released a Known Exploited Vulnerabilities Catalog detailing all of the identified flaws for devices and software produced by companies like Apple, Cisco, Microsoft, Google, and many more, and federal agencies will have to mitigate these known vulnerabilities to become compliant with government regulations. This order is a binding directive and states that all vulnerabilities identified in 2021 must be addressed no later than November 17, 2021, with an implemented patch deadline no later than May 3, 2022. Along with the catalog and advisory, CISA also states it will be implementing a new strategy and methodology for remediating vulnerabilities that moves away from prioritizing them based on severity. After consolidating exploit statistics, CISA will now be prioritizing the vulnerabilities that are actively being exploited, as opposed to prioritizing ones that are labeled as critical. “This directive does two things. First, it establishes an agreed upon list of vulnerabilities that are being actively exploited,” Tim Erlin, Tripwire’s VP of Strategy, said. “Second, it provides due dates for remediating those vulnerabilities. By providing a common list of vulnerabilities to target for remediation, CISA is effectively leveling the playing field for agencies in terms of prioritization. It’s no longer up to each individual agency to decide which vulnerabilities are the highest priority to patch.”