As cited
Copy frozen at (site build).
regulatory
Risky Bulletin: NIST gives up enriching most CVEs
The National Institute of Standards and Technology (NIST) announced a shift in its National Vulnerability Database (NVD) policy to enrich only a subset of vulnerabilities due to capacity constraints. Going forward, NIST will prioritize enrichment for vulnerabilities deemed critical to the safe operation of U.S. government and private sector networks, rather than attempting to enhance all reported flaws.
Why it matters: Security teams relying on NVD enrichment for vulnerability prioritization will need to identify alternative sources for data on non-critical vulnerabilities, potentially increasing operational burden and reducing visibility into lower-severity but exploitable flaws.
- Source published
- First seen by Cybersecurity Tracker