CISA KEV patch-or-wait: use due dates, reachability evidence, and signed VEX
Patch CISA KEV entries by the catalog due date. Start a 3-business-day reachability clock at KEV add to decide patch or defer with signed VEX evidence. Independent technical note mirroring the canonical version: https://tomoguides.com/blog/cisa-kev-patch-or-wait-use-due-dates-reachability-evidence-and-signed-vex.php
Authors
- Blake Ferguson
Publication Details
- Journal
- Zenodo (CERN European Organization for Nuclear Research)
- Published
- 2026-11-07
- DOI
- https://doi.org/10.5281/zenodo.24043578
- Primary Topic
- Information and Cyber Security
- Type
- preprint