/ 
SSVC-1.00
/ SSVC::CISA::BOD2604

NAME

SSVC::CISA::BOD2604 - SSVC CISA BOD 26-04 Response Model (remediation timeline)

SYNOPSIS

use SSVC::CISA::BOD2604;

$ssvc = SSVC::CISA::BOD2604->new(
  in_kev            => 'yes',
  publicly_exposed  => 'yes',
  automatable       => 'yes',
  technical_impact  => 'total',
);

# Get the decision
say $ssvc->decision; # 3_days_forensic_investigation

# Convert SSVC in JSON in according of SSVC JSON Schema
$json = encode_json($ssvc);

DESCRIPTION

The CISA BOD 26-04 Response Model determines the remediation timeline CISA's Binding Operational Directive 26-04 assigns to a vulnerability, based on whether it is in the CISA KEV catalog, whether the affected asset is publicly exposed, whether it is automatable, and its technical impact.

Unlike SSVC::CISA (the older CISA SSVC v2 guide, producing a Track/Track*/Attend/Act decision), this model produces a remediation timeline: fix_on_system_upgrade, 60_days, 14_days, 3_days or 3_days_forensic_investigation.

https://certcc.github.io/SSVC/howto/cisa_response/

CISA BOD 26-04 Response Model

OBJECT-ORIENTED INTERFACE

$ssvc = SSVC::CISA::BOD2604->new(%params)

Creates a new SSVC::CISA::BOD2604 instance using the provided decision points.

Parameters / Decision Points:

  • in_kev (required)

  • publicly_exposed (required)

  • automatable (required)

  • technical_impact (required)

$ssvc->decision

The CISA BOD 26-04 remediation timeline: fix_on_system_upgrade, 60_days, 14_days, 3_days or 3_days_forensic_investigation.

$ssvc->TO_JSON

Helper method for JSON modules (JSON, JSON::PP, JSON::XS, Mojo::JSON, etc).

DECISION POINTS

$ssvc->in_kev

Is the vulnerability listed in the CISA Known Exploited Vulnerabilities (KEV) catalog?

$ssvc->publicly_exposed

Is the affected asset accessible to unauthenticated or untrusted entities via public networks?

$ssvc->automatable

Can an attacker reliably automate creating exploitation events for this vulnerability?

$ssvc->technical_impact

The technical impact of the vulnerability.

SEE ALSO

SSVC, SSVC::Base, SSVC::CISA

[Carnegie Mellon University] SSVC: Stakeholder-Specific Vulnerability Categorization (https://certcc.github.io/SSVC/)
[CISA] Binding Operational Directive 26-04 (https://certcc.github.io/SSVC/howto/cisa_response/)

SUPPORT

Bugs / Feature Requests

Please report any bugs or feature requests through the issue tracker at https://github.com/giterlizzi/perl-SSVC/issues. You will be notified automatically of any progress on your issue.

Source Code

This is open source software. The code repository is available for public review and contribution under the terms of the license.

https://github.com/giterlizzi/perl-SSVC

git clone https://github.com/giterlizzi/perl-SSVC.git

AUTHOR

  • Giuseppe Di Terlizzi <gdt@cpan.org>

LICENSE AND COPYRIGHT

This software is copyright (c) 2025-2026 by Giuseppe Di Terlizzi.

This is free software; you can redistribute it and/or modify it under the same terms as the Perl 5 programming language system itself.