CISA BOD 26-04 explained: printers are now on the federal attack-surface map.
On June 10, 2026, CISA issued Binding Operational Directive 26-04. Buried in Requirement 8 is the first federal directive text that names printers as a reportable, remediable asset class, private IP addresses included. The clock runs out December 7, 2026. This page covers what the directive says, who it binds, what assessors will flag, and what to do whether you are a federal agency or a bank, dealership, school district, or hospital that will inherit the standard.
BOD 26-04 quick facts
| Item | Detail |
|---|---|
| Full title | BOD 26-04, "Prioritizing Security Updates Based on Risk" |
| Issued by | Cybersecurity and Infrastructure Security Agency (CISA) |
| Issued | June 10, 2026 |
| Who it binds | Federal Civilian Executive Branch (FCEB) agencies. It does not bind private companies. |
| What it replaces | BOD 19-02 (internet-accessible systems, 2019) and BOD 22-01 (Known Exploited Vulnerabilities, 2021), both revoked June 10, 2026 |
| The printer clause | Requirement 8, Phase III: all assets in the CDM Federal Dashboard, "including ... printers," must carry all associated IP addresses, including RFC 1918 / RFC 4193 private addresses |
| Phase III deadline | 180 days from issuance: December 7, 2026 |
| Primary source | cisa.gov: BOD 26-04 |
What BOD 26-04 actually requires
A Binding Operational Directive is a compulsory order to every federal civilian agency. BOD 26-04 throws out the one-size-fits-all patching deadlines of the prior decade and replaces them with a four-variable risk model. For every vulnerability on every asset, agencies score Asset Exposure (is it publicly reachable?), KEV Status (is the vulnerability in CISA's Known Exploited Vulnerabilities Catalog, meaning attackers are actively using it?), Exploit Automation (can the attack be scripted?), and Technical Impact (partial or total control of the asset).
Remediation clocks scale with that score. The worst combination must be fixed within 3 calendar days plus forensic triage to check whether compromise already happened. Lower tiers step down through 14-day and 60-day windows to "fix on system upgrade" for the lowest-risk findings. Non-exposed, internal-only assets carry their own 14- and 60-day tiers. "Internal" is no longer an out-of-scope condition; it is a tracked category with a clock.
Agencies that have not automated asset reporting must submit machine-readable updates to CISA every seven days, so inventory gaps stay continuously visible instead of surfacing once a year at exam time.
Requirement 8, verbatim, and in plain English
Under "Required Actions, Phase III, Within 180 days of issuance," item 8 reads in full:
"Agencies shall ensure that all assets reported in the CDM Federal Dashboard, including workstations, servers, mobile devices, cloud assets, printers, and other networked assets, include all associated IP addresses, including RFC 1918 (IPv4) or RFC 4193 (IPv6) private IP addresses."
CISA, BOD 26-04, Required Actions, Phase III, item 8
RFC 1918 and RFC 4193 define private, internal-only network addresses: the 10.x, 172.16.x, and 192.168.x ranges where nearly every printer on earth lives. In plain terms, printers must appear in the federal asset dashboard (the Continuous Diagnostics and Mitigation program, or CDM) even when nothing on the internet can reach them. Companion item 7 requires every asset to be tagged by organization, environment, exposure (public or internal), and asset type.
This is the first time the word "printers" appears in the required-action text of a federal cybersecurity directive. Earlier directives covered printers in principle ("all IP-addressable assets") and missed them in practice. Requirement 8 closes that argument.
Why printers were off the map until now
No prior directive exempted printers. The exclusion was practical, and it worked through three mechanisms.
1. Scope followed internet reachability
BOD 19-02, the operative remediation rule from 2019 until this June, was titled "Vulnerability Remediation Requirements for Internet-Accessible Systems." Devices on private addresses sat outside the regime by definition. BOD 26-04 revokes 19-02 and deliberately pulls private address space in.
2. The tooling could not see them
Federal asset visibility leans on software agents installed on endpoints. Printers cannot run agents. BOD 23-01 (2022) required discovery every 7 days and vulnerability enumeration every 14 days across all IP-addressable assets, but industry analyses of its rollout found agencies lacked visibility into embedded devices such as printers, cameras, and building controllers because discovery tools misclassified or missed them.
3. Scanning printers breaks printers
Embedded print firmware behaves badly under active vulnerability scanning: devices crash or spit out pages of scan traffic. Tenable Nessus, one of the most widely deployed scanners, files printers under "Fragile Devices," marks them as dead hosts, and excludes them from active scanning unless an operator opts in. Across government and industry, the result has been printer segments that security tooling skips by default.
Net effect: an asset class that was in scope on paper was invisible in practice, and even where printers were inventoried, the records lacked the private-IP associations needed to match them to vulnerability data. Requirement 8 exists to close precisely that gap.
Does BOD 26-04 apply to private industry?
Not as law. The directive binds federal civilian agencies and no one else. That is the correct legal answer, and it is the wrong planning answer.
Federal remediation frameworks propagate outward every time. FedRAMP published a formal response to BOD 26-04 within weeks of issuance. The KEV Catalog created by BOD 22-01 in 2021 became the default commercial benchmark in vendor-risk reviews within two years. Nobody passed a law requiring banks to track KEV; their examiners, insurers, and vendor-risk questionnaires simply started asking. The same mechanism is already moving on printer fleets.
Our position, stated plainly: by 2027, auditors, cyber-insurance underwriters, and vendor-risk questionnaires in regulated industries will ask whether your printer fleet is inventoried with private IPs, scanned on a cadence, patched against KEV entries on a clock, and sending scans over enforced encryption. The organizations that move before their auditor does will spend a fraction of what the ones who wait spend. Print security is already among the most under-managed risk areas in independent research: Quocirca's Print Security Landscape reported print-related data loss at 67 percent of organizations in 2024 and 56 percent in 2025.
If you answer to GLBA, the FTC Safeguards Rule, HIPAA, FERPA, FFIEC guidance, or NY DFS Part 500, the encryption-in-transit language that BOD 26-04 logic lands on is already in your rulebook. The directive just told your assessor where to look.
What assessors will flag once printers are visible
With printer fleets in inventories and subject to risk-tiered clocks, four findings follow directly from the directive's logic and from existing audit practice. Each is checkable by a reviewer with access to network configuration and mail infrastructure.
| Finding | Why it fails |
|---|---|
| Incomplete asset inventory | Printer fleets absent from asset reporting, or present without private-IP associations, fail the plain text of Requirement 8. |
| Scan exclusion of printer segments | Vulnerability enumeration that skips printer VLANs leaves the cadence required since BOD 23-01 unmet for an entire asset class. |
| KEV-listed vulnerabilities aging past their clocks | Actively exploited print-infrastructure vulnerabilities are already in the KEV Catalog (CVE-2023-27350 in PaperCut MF/NG carried confirmed real-world exploitation in CISA advisory AA23-131A). Firmware patching on mixed fleets routinely exceeds 14-day windows, and some legacy devices cannot be patched at all. |
| Cleartext SMTP egress | Outbound port 25 traffic from device segments is directly observable and increasingly written up as an encryption-in-transit finding under GLBA, HIPAA, and FTC Safeguards language. |
The port 587 fix is necessary and insufficient
The standard response to the fourth finding is to enable authenticated SMTP with TLS on port 587. Do it. It closes the cleartext finding. Reviewers who look one layer deeper will find four residual gaps it does not touch:
Unenforced encryption. Most MFP configurations fail open: when TLS negotiation fails, the device sends anyway or accepts an unvalidated certificate. "TLS is configured" and "encryption is enforced" are different audit answers.
Credentials concentrated on the device. SMTP authentication requires storing a working mail credential in the printer, behind an admin login that frequently remains at default. The pass-back vulnerabilities disclosed in Xerox VersaLink MFPs (CVE-2024-12510, CVE-2024-12511) captured exactly this class of device-stored credential. Port 587 does not reduce that exposure; it introduces the credential it depends on.
Persistence at rest. One encrypted hop ends at the mail relay. The document then rests unencrypted, indefinitely, in mailboxes, sent-items folders, archives, and backups.
No delivery evidence. SMTP at any port produces no per-document record of who received a scan, when, from where, or whether anyone else has opened it since. These are the questions examiners ask in walkthroughs.
BOD 26-04 anticipates this. Its remediation notes state that "the timelines for each asset are dynamic as facts change" and cite removing an asset's exposure as valid mitigation. Compensating controls that remove the vulnerable pathway are a sanctioned path when patching cannot meet the clock.
BOD 26-04 printer fleet compliance checklist
Eight items, in the order an assessor will check them. Federal agencies need all eight by December 7. Everyone else should treat the list as the 2027 exam prep it is.
- Inventory every printer and MFP with its private IP. Model, firmware version, VLAN, location, owner, RFC 1918 or RFC 4193 address. Tag exposure as internal or public per Requirement 7.
- Put printer segments back into discovery and enumeration. If your scanner skips "fragile devices," use passive discovery or vendor-safe scan profiles rather than leaving the VLAN dark. Seven-day discovery, fourteen-day enumeration.
- Match firmware against the KEV Catalog. Any device running a KEV-listed version starts a clock the day you find it.
- Define the compensating control for what you cannot patch. Legacy devices that will never see a firmware update need a documented mitigation that removes the exposed pathway, not a risk-acceptance memo.
- Block outbound port 25 from device segments. Cleartext SMTP egress is the easiest finding to write and the easiest to close.
- Enforce encryption on the scan-to-email path, fail closed. Port 587 with TLS and certificate validation, and a device that refuses to send when it cannot meet that bar.
- Remove reusable mail credentials from the device. If an attacker who owns the admin panel can harvest a working SMTP login, the control is incomplete.
- Produce per-document delivery evidence. Who received each scan, when, from where, and whether anyone else has accessed it. If the answer is "check the mail server logs," you do not have it.
Items 5 through 8 are the scan-to-email gap in full. Device hardening (items 1 to 4) has vendor tooling. Transport does not, which is why it is the finding assessors reach first. The MFP security best-practices guide covers the device-side controls in depth.
How SecureMFP addresses the scan-to-email gap
Enabling TLS on port 587 is an armored truck from your office to the local post office: the first mile is protected, and after the handoff the document travels ordinary mail with a copy left in every mailroom it passes through. The alternative is a Brinks run straight to the recipient: one custodied trip, a signature on delivery, no mailroom copies. SecureMFP, built on Botdoc's patented Secure Digital Transport, implements the second model for the scan-to-email path on the MFPs you already own.
Enforced transport, fails closed. SecureMFP requires the secured path: port 587, TLS, and a validated certificate. A device that cannot meet that bar does not fall back to plaintext. It does not send.
Credential exposure removed. Credentials are bound to the specific machine on first connection, so captured or replayed credentials do not work from any other device, and no reusable mail credential sits behind the printer's admin login.
No persistence in email. Documents are delivered as expiring secure links rather than attachments. A single encrypted copy is held for delivery and automatically purged, 14 days by default, on infrastructure examined annually under SOC 2 Type 2 by an independent auditor.
Delivery evidence by design. Every transmission carries a per-document access log: who received it, when, from where, and whether anyone else has touched the record since. This is the evidence format vendor-risk reviews and examination walkthroughs request.
SecureMFP does not replace print-management platforms such as PaperCut; it secures the transport leg they hand off to email. Deployment is roughly five minutes per device with no firmware change and no copier replacement, across HP, Canon, Xerox, Konica Minolta, Ricoh, Sharp, Toshiba, and Lexmark. Details are on the technology page; the examiner-facing version is at For Auditors.
BOD 26-04 FAQ
What is BOD 26-04?
BOD 26-04, "Prioritizing Security Updates Based on Risk," is a Binding Operational Directive issued by CISA on June 10, 2026. It replaces BOD 19-02 and BOD 22-01 with a risk-tiered vulnerability remediation model for federal civilian agencies and, in Requirement 8, requires every networked asset including printers to be reported in the CDM Federal Dashboard with all associated IP addresses, private ones included.
When is the BOD 26-04 deadline?
Phase III is due within 180 days of issuance. Counting from June 10, 2026, the Phase III deadline, which includes the Requirement 8 printer and private-IP reporting obligation, is December 7, 2026.
Does BOD 26-04 apply to private companies?
No. A Binding Operational Directive binds Federal Civilian Executive Branch agencies only. Federal remediation frameworks do propagate outward: FedRAMP responded to BOD 26-04 within weeks, and the KEV Catalog created by BOD 22-01 became a de facto commercial vendor-risk benchmark. Expect auditors, insurers, and vendor-risk questionnaires to adopt BOD 26-04 language for printer fleets.
What does BOD 26-04 say about printers?
Requirement 8 states that agencies shall ensure all assets reported in the CDM Federal Dashboard, including workstations, servers, mobile devices, cloud assets, printers, and other networked assets, include all associated IP addresses, including RFC 1918 and RFC 4193 private addresses. It is the first time printers are named in federal directive required-action text.
What will auditors flag under BOD 26-04 logic?
Four findings: printer fleets missing from inventories or lacking private-IP associations, vulnerability scans that exclude printer segments, KEV-listed print vulnerabilities aging past their clocks, and cleartext SMTP egress from device segments, which is already an encryption-in-transit finding under GLBA, HIPAA, and FTC Safeguards.
Is enabling TLS on port 587 enough to fix scan-to-email?
Necessary, not sufficient. It protects one hop and leaves four gaps: fail-open encryption, a reusable mail credential stored on the device, unencrypted persistence in mailboxes and archives, and no per-document delivery evidence. BOD 26-04 explicitly recognizes compensating controls that remove the vulnerable pathway as valid mitigation.
Related reading
Find out where your fleet fails the four findings
A SecureMFP specialist will walk your printer fleet against the BOD 26-04 checklist, show where the scan-to-email path fails the four examiner questions, and map the compensating control for your regulatory environment. Thirty minutes is the standard slot.