CISA BOD 22-01 explained: KEV due dates
Reviewed November 11, 2026 · figures computed from 1,780 CISA-listed CVEs in the 0dayNews dataset at build time
BOD 22-01, "Reducing the Significant Risk of Known Exploited Vulnerabilities", is a directive CISA issued in November 2021. It requires US federal civilian executive branch agencies to remediate every vulnerability in the KEV catalog by the due date attached to the entry.
Who it binds
The directive is binding on federal civilian executive branch (FCEB) agencies. It does not legally apply to private companies, but CISA encourages every organization to use the catalog to prioritize remediation, and many do, which is why the KEV due date appears on our CVE pages.
How the due date works
Each KEV entry has a "required action" (usually to apply vendor updates or mitigations, or to stop using the product if none exist) and a due date. The due date is the date by which agencies must have done it.
Counted from 1,779 CISA-listed records in our dataset, the median gap between the date added and the due date is 21 days. 1,025 entries (58%) have a 21-day window and 290 (16%) have a 14-day window. The remainder have other lengths.
What a due date does not mean
A due date is a compliance deadline for agencies, not the moment exploitation starts or stops. Exploitation is usually already under way when an entry is added. For anyone outside the federal government, treat the date as the latest reasonable target, not a grace period.
Where to see it on 0dayNews
Every CISA-listed CVE page shows the required action and due date. The KEV tracker lists them all and the KEV changes log records additions as they happen.