Moving from KEV alerts to a documented remediation exception process

What the documents cover and what they leave out

Three CISA documents bear on this question. Two are KEV alerts, dated October 30, 2026 and November 3, 2026. The third is the October 26, 2026 press release for the strategy "CISA 2030: Defend, Harden, Prevail."

None of them sets out an exception process. The alerts name the added vulnerabilities and point to Binding Operational Directive (BOD) 26-04. They do not list a remediation deadline, and they do not describe how to request or approve a delay. The strategy release is a high-level announcement and says nothing about KEV deadlines.

So this guide does not invent a process. It sets out what the documents do say about prioritization, compromise checks and review. It then shows which records those statements point a CISO toward.

What the KEV alerts say

The October 30 alert says CISA added two Ivanti Connect Secure vulnerabilities to the catalog. One is a missing authentication flaw, CVE-2026-111357, and the other a predictable-identifier flaw, CVE-2026-118527. The alert says each addition is based on evidence of active exploitation.

The November 3 alert adds a WordPress Core flaw, CVE-2026-119977.

Both alerts use the same wording on risk. The alerts present a KEV listing as a statement that exploitation has been observed. They do not frame it as a theoretical rating.

What BOD 26-04 requires, according to the alerts

Both alerts summarize BOD 26-04. The summary has three parts that matter for an exception file.

First, the directive sets a priority order. The alerts therefore describe three conditions for the fastest track. The CVE is in the KEV Catalog. The asset is publicly exposed. Exploitation gives total control of the asset.

Second, the alerts say the directive lets lower-risk items be deferred. The alerts do not say how that deferral is documented.

Third, the directive covers the time before a patch. The alerts do not spell out those expectations, so a reader has to go to the directive itself for them.

Who the directive binds

The alerts are specific about scope. BOD 26-04 A private company is not bound by it.

CISA still addresses everyone else in the same paragraph. and to prioritize remediation of KEV Catalog vulnerabilities. For a non-federal CISO, the KEV listing is a strong external signal but not a legal deadline. For a federal agency, the directive's requirements apply.

What a CISO can record, approve and review

The documents give no template for an exception. They do supply criteria that a record can be built around. The list below is drawn from those criteria. It is not a CISA-issued form.

• Record the KEV facts. Note the CVE, the product, the date of the alert, and CISA's statement that the listing rests on evidence of active exploitation.
• Record the exposure test. The alerts tie the highest priority to publicly exposed assets where exploitation grants total control. An exception file can state whether each affected asset meets both conditions. The alerts do not say what to do if only one condition is met.
• Record the compromise check. BOD 26-04 sets expectations for checking whether threat actors got in before the patch. A file can note whether that check was done and what it found.
• Record the mitigation status. The alerts say KEV additions need That sentence is about nominating a vulnerability for the catalog. It does show that CISA expects mitigation guidance to exist for each listed item, so the file can cite the guidance the vendor gave.
• Approve with a named owner. The documents name no approver. The file needs the CISO's own decision on who signs off, and the sign-off should sit next to the risk facts above.
• Review on a schedule. The documents set no review interval for exceptions. The CISO sets one, and the KEV status of the CVE is the first thing to recheck.

What the strategy adds on review and follow-through

The October 26 strategy release does not touch KEV deadlines. It does show how CISA frames its own work, and the same ideas can shape an internal exception process.

The release says CISA is shifting its stance. It also says the agency will work on risk ranking and speed.

CISA also puts dates on its own follow-through.

The pattern is a review, then a plan with measures, then a progress report. An exception file can follow the same sequence: a decision, a dated plan and a report on progress. The documents do not say CISA expects this of other organizations.

The release also carries a call from Acting Director Nick Andersen. he said. The statement is general and does not mention exceptions.

Where the documents stop

The documents support four points. A KEV listing means exploitation has been observed. BOD 26-04 gives the highest priority to KEV items on publicly exposed assets where exploitation gives total control. The directive expects agencies to check for compromise before patching. And CISA encourages all organizations to adopt risk-based vulnerability management, though only federal civilian agencies are bound.

The documents do not support a specific exception form, an approval chain, a maximum delay or a review interval. Those details need the full text of BOD 26-04, which the alerts link to, or the organization's own policy. A CISO who writes the exception policy should cite the directive directly and keep the record fields above tied to the criteria CISA has published.