15/09 edition: a KEV deadline is not automatically a Portuguese duty

The catalogue answers a particular question

For a Portuguese team, the useful decision is not 'which American deadline do we copy?' but 'where do we have this product, and what action do we justify now?'. This edition addresses vulnerability owners, operations and service owners. It does not announce a 15 September catalogue addition or list CVEs; it recovers a prioritisation question using sources accessed in October.

CISA describes three KEV inclusion criteria: an assigned CVE identifier, reliable evidence of exploitation in the wild and clear remediation action. An entry is a signal about the vulnerability; it does not show that equipment in your organisation has been compromised.

The directive version matters too

The current BOD 26-04 text, issued on 10 June 2026, revokes and supersedes BOD 22-01. CISA identifies FCEB systems and agencies as its federal scope. Do not present the old directive as current or turn its federal obligation into a general duty for every Portuguese SME.

CISA also recommends that other organisations use KEV in prioritisation. Our bounded interpretation is that recommendation and binding obligation differ. A contract or another applicable rule may add duties; this article does not assess them. Keep that question separately, with its basis, instead of combining everything in a 'CISA deadline' column.

Match the signal to an instance

The UK's NCSC recommends understanding systems, software and service owners, with discovery and configuration as ongoing processes. This is foreign technical guidance, not Portuguese law. Velqory's adaptation starts with a concrete instance: asset identity, version, affected component, access path and supported service.

A brand in an old inventory cannot establish presence or absence. Ask the maintainer to confirm and date the evidence. Include outsourced services: 'it belongs to the supplier' should generate an evidence request, not remove the asset from the queue. If exposure is unknown, retain a priority clarification task with an identified decision-maker.

Three deadlines, three bases

This original matrix does not reproduce directive intervals. The service owner should choose an internal deadline considering exposure and consequences, while security retains the reason. Acceptance asks whether another person can reconstruct the decision without relying on a conversation.

An 'internal' asset has another route

Hypothetical scenario: operations considers a device internal, but a provider retains remote access. The team chooses to wait for the catalogue deadline without examining that route. Our proposed exercise maps authorised access and confirms who controls each path; it does not execute an exploit.

If the only evidence is 'it does not appear in the external scan', exposure remains unresolved. The service owner should decide a provisional action and assign confirmation. Do not call proposed segmentation effective before authorised testing, or declare an incident solely because the vulnerability matches KEV.

A decision that survives the next meeting

Our proposed outcomes are four states: absent with evidence, present with assigned action, temporarily mitigated with review, or unknown under investigation. Avoid treating 'notified' as resolved. Retain the vendor advisory used, requested change and next verification.

The editorial value is making this distinction without slowing the response: absence of federal binding authority does not make the vulnerability irrelevant. Velqory recommends justifying your own deadline, potentially more demanding where context warrants it, and keeping Portuguese and contractual obligation analysis separate.