---
title: "CISA KEV (CISA BOD 22-01)"
slug: "cisa-bod-22-01"
updated: 2026-06-25T19:44:18Z
published: 2026-06-25T19:44:18Z
canonical: "help.nucleussec.com/cisa-bod-22-01"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.nucleussec.com/llms.txt
> Use this file to discover all available pages before exploring further.

# CISA KEV (CISA BOD 22-01)

## Overview

> [!NOTE]
> Note the rename
> 
> The CISA BOD 22-01 was relaunched as the CISA KEV (Known Exploited Vulnerabilities) list in 2022. You will see references to both CISA BOD & CISA KEV in Nucleus documentation and platform depending on if you are a federal customer or commercial client.

On November 3, 2021, the Cybersecurity and Infrastructure Security Agency (CISA), a branch of the U.S. Department of Homeland Security (DHS), released [Binding Operational Directive (BOD) 22-01](https://cyber.dhs.gov/bod/22-01/). Cybersecurity directives from CISA are infrequent, the last being issued on September 2, 2020, and they tend to be at a rather high level. BOD 22-01 is different, because it instructs agencies to remediate a specific list of vulnerabilities, and it attaches strict deadlines. Importantly, this directive is a requirement, and not simply guidance or a recommended best practice.

The target for this BOD is government organizations. However, it is not at all uncommon for private industry to adopt government standards once they become aware of them. Organizations with significant government contracts in their book of business would do well to comply and be able to prove compliance upon demand. Fortunately, Nucleus simplifies compliance with CISA BOD 22-01.

## Where to find and how to use

CISA BOD 22-01 results can be found, associated with specific CVEs, on the Vulnerability Intelligence tab of the detail view on any vulnerability or compliance finding.

**View CISA KEV status on a finding:**

1. Navigate to **Global Dashboard > Project > Explore > Vulnerabilities** to view the Active Vulnerabilities page.
2. Click on any vulnerability to open the detail view.
3. Select the **Vulnerability Intelligence** tab.
4. Look for the CISA KEV field, which displays:
  1. KEV Status: Whether the CVE is on the CISA Known Exploited Vulnerabilities list
  2. Due Date: The CISA-mandated remediation deadline (if applicable)

![](https://cdn.document360.io/3888970a-6501-459e-acc9-c47b71c6d64c/Images/Documentation/CISAKevVulnDetails.png)

**Filter by CISA KEV status:**

1. Navigate to **Explore > Vulnerabilities**.
2. Click the Filter button to open the query builder.
3. Add a filter condition: CISA KEV Vulnerability = Yes.
4. Apply the filter to view only vulnerabilities on the CISA KEV list.

Additionally, CISA BOD 22-01 can be used as criteria for triggering automation rules that create downstream events like [Finding Processing](/v1/docs/finding-processing-rules) and [Notifications](/v1/docs/notification-rules).

**Create automation rules using CISA KEV:**

1. Navigate to **Automation**.
2. Create a new rule with trigger criteria based on CISA KEV Vulnerability = Yes.
3. Configure downstream actions such as:
  1. Auto-assign to specific teams
  2. Set due dates based on CISA deadlines
  3. Send notifications to stakeholders
  4. Adjust finding priority or severity

> [!NOTE]
> **NOTE:** When evaluating **CISA Known Exploited Vulnerabilities (KEV)** status across Findings, Nucleus currently only checks the **primary CVE** in each finding’s vulnerability intelligence record. If a finding contains multiple CVEs, only the first (primary) CVE determines whether the finding is marked as KEV-true.