IST outlines proposal to restructure NIST vulnerability program with focus on standards setting

"Vulnerability data is not the goal — safer software and reduced harm to people, infrastructure, and institutions are. Vulnerability data is the means to measure progress toward that goal and to support accountability for the products that manufacturers ship," IST says in an Oct. 13 filing to NIST.

IST published an executive summary of the filing in an Oct. 19 blog post. NIST issued an Aug.

12 request for information to inform the modernization of the NVD program. The comment period closed Oct. 13.

The filing was submitted by IST and the Software Safety Institute, which was launched by former Cybersecurity and Infrastructure Security Agency officials Bob Lord and Lauren Zaberiek. The NVD program primarily serves to enrich vulnerabilities ingested through CISA’s Common Vulnerabilities and Exposures program. NIST has faced challenges since 2024 in keeping pace with enriching the vulnerability records.

The filing proposes four “structural changes” for NIST to revamp the program, starting with a proposal to “sunset NVD's record-level enrichment function and, working with Congress, transfer the NVD enrichment budget to CISA.” IST and the Software Safety Institute also recommend NIST setting explicit standards for the completeness, accuracy and timeliness of vulnerability records at the time of creation. The filing urges NIST to “formalize a provenanced attribute data model for severity and exploitability claims.” CISA can leverage the standards set by NIST to measure the quality of vulnerability records, according to the filing, “so that record quality becomes visible to manufacturers, operators.” NIST’s maintenance responsibilities for the Common Platform Enumeration program should be retired, according to the filing. The CPE program provides a standardized naming scheme to identify information technology systems.

The filing says NIST should transfer the responsibility for CPE to the organizations who develop vulnerability records through the CVE program. As part of the RFI, NIST asked for ideas on opportunities to integrate artificial intelligence tools into the NVD program. IST responded by urging NIST to not add “new capabilities to NVD, AI-enabled or otherwise.” The filing argues, “The Common Vulnerabilities and Exposures ecosystem has outgrown the third-party enrichment role the National Vulnerability Database was built to play.” “The central problem is not processing capacity, and AI-enabled automation will not solve it.

It is the absence of accountability for the quality of CVE records at the point they are created,” according to the filing. “Beyond the NVD, we urge NIST to set secure-by-design software expectations for AI code generation in its secure development guidance,” the filing says. IST asks the agency to incorporate secure by design principles in a 2024 profile of the NIST Secure Software Development Framework for generative AI and dual-use foundation models.