Modernizing the National Vulnerability Database for Growing Cyber Risks | Blogs

Source Domain: itif.org

Cyber vulnerabilities are growing in frequency, complexity, and severity. In May 2026, the Commerce Department’s Inspector General issued a report finding significant operational and governance failures within the National Institute of Standards and Technology’s (NIST) National Vulnerability Database (NVD) and directed the agency to develop a plan to address them. As NIST prepares its strategy, it should prioritize reforms that improve cross-agency coordination, modernize infrastructure, and rebuild trust within the cybersecurity community.

Managed by NIST, the NVD serves as the federal government’s primary repository of publicly disclosed cybersecurity vulnerabilities. Organizations use this database to assess and prioritize cyber risk, such as helping a federal agency determine whether a newly disclosed vulnerability threatens a public-facing system. Many organizations integrate the NVD into their cybersecurity tools and risk management processes, and delays or gaps in its data can affect both government and industry preparedness. The inspector general’s report found that the NVD suffers from significant backlogs, inefficient processing of new vulnerabilities, duplication of efforts with other federal agencies, and limited stakeholder engagement, underscoring the need for modernization.

One of the most pressing issues the report identifies is an overlap between NIST and the Cybersecurity and Infrastructure Security Agency (CISA). CISA focuses on helping organizations respond to active cyber threats, such as through the Known Exploited Vulnerability catalog, while NIST is responsible for maintaining the vulnerability data and standards that underpin the broader cybersecurity ecosystem. However, as the NVD backlog has grown, CISA has expanded its own vulnerability analysis work, known as the Vulnrichment program, to support operational needs, causing both agencies to review similar information in areas such as vulnerability classification and enrichment.

To…

Source