The Cybersecurity and Infrastructure Security Agency (CISA) has issued a directive requiring federal agencies to patch the most critical cyber vulnerabilities within three days. Released Wednesday, the mandate gives agencies 180 days to fully adopt the new accelerated timeline.
Under the directive, agencies must address the most dangerous flaws — those posing the highest risk — within 72 hours. Less severe vulnerabilities can be deferred under the new framework, though specific timelines for lower-severity issues were not detailed. The policy shift comes amid an evolving threat landscape increasingly shaped by artificial intelligence-powered attacks.
CISA is framing the change as a response to the accelerated pace of modern cyber threats. The three-day window applies to vulnerabilities that the agency deems most likely to be exploited in active campaigns. The directive does not specify a minimum CVSS score but focuses on operational risk rather than raw severity numbers.
Agencies now face a six-month transition period to adjust internal workflows and adopt the new patch cycle. CISA said it will provide guidance and technical support during the rollout. The directive did not include penalties for noncompliance, leaving oversight mechanisms unclear.
Critics argue the compressed timeline may overwhelm agency IT teams already stretched thin by legacy systems and workforce shortages. Without additional funding or staffing resources, some cybersecurity experts warn the three-day deadline could lead to incomplete or hasty patching that introduces new errors.