CISA Frames a 'Quality Era' to Improve CVE Data as Disclosure Rates Surge

# What CISA announced

# Why the change now

Faster discovery and automation make vulnerability information more valuable when records are complete and actionable. At the same time, acceleration exposes gaps: uneven submission quality, strained triage and coordination, and pressures on CVE assignment processes.

# What the framework defines

CISA defines quality across four explicit dimensions:

• Program governance: how decisions are made, speed of decisions, and how conflicts of interest are identified and resolved.
• Ecosystem participation: the number and diversity of active CVE Numbering Authorities (CNAs) and broader stakeholder engagement.
• Data infrastructure: system uptime, API performance, and technical modernization to support scale and consistency.
• CVE record content: how many records meet defined quality criteria and how often records require correction after publication.

The paper emphasizes that these dimensions reinforce each other and that no single change will deliver the desired outcome.

# Proposed measures, no targets

CISA lists potential measures tied to the four dimensions: decision timelines, CNA diversity and activity, infrastructure performance metrics, and record-level quality indicators such as post-publication corrections. The agency presents these as options for assessing progress but does not set numerical targets or deadlines in the paper.

# Relationship to existing strategy

The framework maps onto six lines of effort already in CISA's CVE quality strategy: community partnerships, government sponsorship, modernization, transparency, data quality, and the program's CNA of Last Resort. CISA says modernization can make the program more consistent and scalable but cannot substitute for governance maturation or community engagement.

# Community and industry response included in the paper

# Next steps and outreach

CISA plans a blog series on cve.org to detail infrastructure and data modernization work. The agency says it will continue engaging CNAs, researchers, suppliers and downstream data consumers as part of implementing the quality-era approach.

# Practical implications for organizations

Expect an increased focus on record completeness and actionable metadata. Organizations that consume CVE feeds should monitor changes in data infrastructure (API performance, uptime) and be prepared for evolving governance and participation processes as the program formalizes quality measures.