The US Cybersecurity and Infrastructure Security Agency (CISA) has outlined a new framework it says will improve the Common Vulnerabilities and Exposures (CVE) program.

Under the plans, the agency wants to create a more resilient, transparent, and sustainable vulnerability management ecosystem, while making sure that CVE data remains accurate and responsive to a rapidly evolving threat landscape.

According to CISA, the move comes as AI-enabled technologies are creating new pressures across the software lifecycle, while rising vulnerability volumes are placing significant strain on cyber defenders.

"These pressures intensify quality challenges across the CVE ecosystem," said CISA. "While faster discovery and reporting can improve the value of vulnerability information when records are complete, consistent, timely, and actionable, the same acceleration can expose gaps in processes, tooling, coordination, and accountability — especially when the quality of the submissions is uneven."

In a white paper, The CVE Program: Establishing a Quality Era Framework, it lays out four 'dimensions of quality', including:

• Program governance
• Ecosystem participation
• Data infrastructure

Organizations should aim for transparent and effective CVE program governance through clear stewardship, structural maturation, representative ecosystem participation, and collaborative decision making, CISA said.

Similarly, they should be active within the global software development community, including CNAs, Roots, CNAs of Last Resort (CNAs-LR), product suppliers, tool vendors, researchers, and governments, to create engagement, guidance, and feedback.

The systems supporting core CVE operational functions – such as CVE ID reservation and CVE Record publication – should enable quality at scale through robust APIs, schemas, validation libraries, and cve.org.

Elsewhere, CVE records need to be complete, accurate, timely, and actionable so that cyber defenders and downstream users can confidently rely on them.

CISA plans a step in the right direction

Ronald Lewis, head of cybersecurity governance at Black Duck, said the document was a positive step. However, he questioned the vague metrics for success.

"Terms such as "effective governance," "broad participation," "robust infrastructure," and "high-quality records" sound good, but they remain subjective rather than "measurable" – and when a framework isn't measurable, becoming achievable is that much harder," he said.

"For example: What is an acceptable error rate? What is the target turnaround time for CVE enrichment? How quickly should CNAs respond to submissions? What level of data completeness constitutes a quality record? These are the types of metrics needed to figure out whether a program is succeeding or falling behind and ultimately, defining whether or not we can trust that we're investing in what makes us truly safer."

Lewis said he'd like to see specific key performance indicators (KPIs) for each pillar, for example response-time objectives for CVE assignments, data quality thresholds, enrichment timeliness goals, and governance review metrics.

Russel Van Tuyl, VP of security services at SpecterOps, echoed Lewis’ comments, noting that the industry is experiencing a “fundamental change in the economics of vulnerability research”.

“Frontier AI is helping researchers connect evidence, test hypotheses, as well as find and validate exploit chains at a speed that was previously difficult to achieve,” he said.

“CISA’s Quality Era framework is an important recognition that better vulnerability data and faster coordination must accompany faster discovery.”

FOLLOW US ON SOCIAL MEDIA

You can also .