{
  "node_id": "us-cisa-known-exploited-vulnerabilities-bod-22-01",
  "title": "CISA Binding Operational Directive 22-01 - Known Exploited Vulnerabilities Catalog: Federal Agency Mandatory Patch Deadlines (14-Day Critical, 30-Day High), KEV Catalog Methodology, Vendor Coordination, Private Sector Voluntary Adoption and Metrics Reporting",
  "domain": "Cybersecurity",
  "version": "1.0.1",
  "last_updated": "2026-04-30",
  "bluf": "Federal civilian executive branch agencies must remediate vulnerabilities listed in the CISA Known Exploited Vulnerabilities (KEV) Catalog within 14 days for critical severity and 30 days for high severity per Binding Operational Directive (BOD) 22-01. This directive mandates patching timelines, reporting, and coordination with CISA for exploited vulnerabilities actively used in the wild.",
  "paywall": {
    "status": "LOCKED",
    "unlock_cost_usd": "0.01",
    "skyfire_id": "41779894-ece2-4163-9761-b3b1b76e19b0"
  },
  "crosswalks": {
    "_available_keys": [
      "nist_framework",
      "iso_standard",
      "industry_mapping",
      "ai_overlay_2026"
    ],
    "_note": "Full crosswalk values included in vault response"
  },
  "dependencies": [
    "owasp-samm-governance",
    "uk-money-laundering-regulations-2017-amended"
  ],
  "primary_citations_count": 5
}