# BOD 26-04 Risk Tiering

> Computes CISA BOD 26-04 remediation tiers for Tenable vulnerability findings using the directive's 4-variable model.

- Type: Skill
- Author: itschrisyo
- License: MIT
- Trust tier: contributed (passed automated validation and a baseline maintainer review)
- Last reviewed: 2026-07-26
- Source repository: https://github.com/itschrisyo/bod-26-04-risk-tiering
- Repo state: not archived
- Last push: 2026-07-17T04:22:19Z
- Stars: 0 (a popularity signal, not a safety signal)
- Forks: 1 (a popularity signal, not a safety signal)
- Open issues: 0
- Language: Python
- Health checked at: 2026-11-05T20:35:15.821Z
- Integrations: Tenable, Tenable Hexa AI MCP
- Domains: vulnerability-management, governance-risk-compliance
- Tags: bod-26-04, cisa, vulnerability-management, compliance, risk-tiering, kev, tenable
- Date added: 2026-07-16
- Works with the Tenable Hexa AI MCP server: yes
- Compatible platforms: Claude Code
- Invocation: `/bod-26-04-risk-tiering`
- Listing page: https://exchange.tenable.com/skills/bod-26-04-risk-tiering
- Source file: https://github.com/tenable/cyberagents-exchange/blob/main/skills/bod-26-04-risk-tiering.md

This skill automates CISA BOD 26-04 compliance for federal agencies and organizations managing Tenable vulnerability data. It computes remediation tiers using the directive's four-variable risk model: Publicly Exposed × In KEV × Automatable × Technical Impact.

## What it does

Takes Tenable One/TVM vulnerability findings and produces BOD 26-04-compliant remediation tiers with specific deadlines:
- **3-day + forensic triage** (actively exploited KEV on public-facing assets)
- **3-day** (high-risk KEV)
- **14-day** (medium-risk KEV)
- **60-day** (lower-risk)
- **Fix-on-upgrade** (maintenance window)

Pulls data directly from Tenable via Hexa MCP, enriches with CISA Vulnrichment for automation/impact assessments, applies Table 1 logic, and generates action queues with countdown timers from first-seen dates.

## How it works

The skill extracts KEV dates from Tenable Workbench, handles Windows patch bundles by extracting individual CVEs, fetches CISA SSVC assessments via Vulnrichment API, computes tiers using BOD 26-04's 16-row lookup table, and outputs multiple report formats (JSON for automation, CSV for leadership, text for humans). Includes forensic triage flags for potential active breaches and coverage statistics showing CISA data availability.

Production-tested on 500 assets with 539 KEV vulnerabilities, achieving 64.3% CISA coverage. Zero external dependencies (Python stdlib only). 21 unit tests covering all Table 1 rows and edge cases.

This is the Markdown version of one of 140 listings on CyberAgents Exchange. The same listing as JSON: https://exchange.tenable.com/api/skills/bod-26-04-risk-tiering.json. The full index and how to read it: https://exchange.tenable.com/llms.txt