What it asks for. Binding Operational Directive 22-01, issued by CISA in 2021, requires US federal civilian executive branch agencies to remediate vulnerabilities listed in the Known Exploited Vulnerabilities catalogue within the timelines set in the catalogue. It also requires agencies to review and update their vulnerability management procedures to support this.
In practice. For agencies, compliance means tracking KEV entries against asset inventories, remediating by the due date and reporting status as required. Organisations outside its scope often adopt the same approach voluntarily: treating actively exploited vulnerabilities as a separate priority class with tighter deadlines. Evidence includes remediation timelines, exception handling records and reporting dashboards.
Common gaps. Remediation depends on knowing where vulnerable software runs, so weak asset inventories undermine compliance. Internet facing and unmanaged systems are frequently missed.