Tech groups call for streamlining vulnerability disclosure programs run by NIST, CISA

The Aug. 12 request for information asks for stakeholders to provide input on modernizing NIST’s National Vulnerability Database through the use of artificial intelligence. The Information Technology Industry Council argues in a recent filing, “Modernization should strengthen the NVD’s role in making reliable vulnerability information broadly usable.” The comment period closed on Oct.

13. The NVD program enriches vulnerability records from the Cybersecurity and Infrastructure Security Agency’s Common Vulnerabilties and Exposures program. The RFI is in response to a significant NVD enrichment backlog that began in 2024 and has grown due to frontier artificial intelligence models with advanced vulnerability discovery capabilities.

To modernize the program, ITI argues, “NIST should define how the NVD complements the CVE program, the Cybersecurity and Infrastructure Security Agency’s enrichment activities, and the activities of other vulnerability management organizations and programs, technology suppliers, and security providers.” The filing says NIST should prioritize supporting “shared processes and compatible systems across the vulnerability management ecosystem,” while preserving the roles and responsibilities of the organizations tasked with creating vulnerability records, also known as CVE Numbering Authorities. “Clear responsibilities and the reuse of existing information can reduce duplication and allow NIST to focus its expertise in areas that add the greatest value,” the filing says. ITI offers recommendations for NIST to modernize the NVD program through maintaining a dependable and broadly accessible public service, improving data quality and enabling context-based risk decisions and remediation.

The Hacking Policy Council also weighed in on potential changes to the NVD program in a separate filing. “HPC’s primary recommendation is that NIST should work with the broader vulnerability management community to better integrate NVD and the Common Vulnerabilities and Exposures Program through a federated system for vulnerability information built on shared infrastructure and interoperable services,” the second filing says. According to HPC, the separation between the two vulnerability disclosure programs “creates duplication, delays, and additional operational complexity.” The filing says, “Rather than publishing vulnerability information in one system and then separately ingesting, reconciling, enriching, and redistributing it through another, HPC recommends a unified CVE-NVD system built around a single authoritative vulnerability record.” NIST should “continue to play an important role in validation and aggregation” of vulnerability records in the proposed unified database, according to the filing.

HPC argues the unified vulnerability disclosure system should also immediately publish “core vulnerability information” when minimum requirements are met. Additional enrichment information should be included “as additional validated information becomes available,” the filing says. “This approach would reduce duplicate processing, accelerate the propagation of updates, and shorten the path from disclosure to prioritization and remediation,” according to HPC.

HPC says, “The system should maintain one authoritative, versioned vulnerability record, publish core CVE information promptly, enrich that same record progressively, and provide common submission, validation, governance, and conflict-resolution mechanisms.” HPC emphasizes, “Integration should enable the vulnerability ecosystem to operate at greater speed and scale. The ecosystem must absorb both a near-term increase in vulnerability discovery and longer- term growth in the amount of software and vulnerabilities requiring management.