Identifying and resolving security flaws and weaknesses in IT infrastructure—known as vulnerability management—helps prevent cyberattacks, data breaches, and system disruptions. The National Vulnerability Database (NVD), maintained by the National Institute of Standards and Technology (NIST), provides data for vulnerability management to cybersecurity professionals in the public and private sectors. A backlog of unprocessed vulnerabilities began in February 2024 and continued to grow, undermining the NVD’s utility and public trust.
Our objective was to evaluate the effectiveness and sustainability of NIST’s processes for managing cybersecurity vulnerabilities submitted to the NVD, including the long-term effectiveness of NIST’s strategy for reducing its vulnerability backlog and its measures to prevent future processing delays. NIST considers the NVD a key piece of the U.S. cybersecurity infrastructure, but its actions to resolve the growing backlog did not reflect that characterization. We found that NIST did not have sustainable processes to manage NVD submissions and would be unable to clear the backlog of unprocessed vulnerabilities or prevent future processing delays without significant changes.
We made six recommendations to help NIST manage and establish priorities for the NVD, improve the efficiency and sustainability of enrichment processes, and ensure the best use of government resources.
