Topic · nist

NIST (general)

General NIST publications and NCCoE practice guides — SP 1800-series, framework updates, AI/blockchain/post-quantum drafts that don't fit a specific SP 800-* number.

RSS feed ↗

trade-press
OT coalition urges ISA/IEC 62443 as unified ICS standard
CIRCIA's harmonization exception lets entities skip duplicate reporting, but without a shared OT baseline to measure "substantially similar" against, the exception can't deliver what it promises.
The Operational Technology Cybersecurity Coalition released a July 23 position paper urging federal policymakers to adopt ISA/IEC 62443 as a single horizontal standard for industrial control system security. Operators currently navigate overlapping mandates (the paper cites TSA pipeline security directives and NERC Critical Infrastructure Protection standards as examples) with no shared technical baseline across sectors. Coalition executive director Tatyana Bolton told Inside Cybersecurity that CIRCIA's proposed harmonization exception, which lets entities skip duplicate reporting under a "substantially similar" framework, can't function cleanly for OT until regulators agree on a common standard to measure similarity against.
YESTERDAY
trade-press
NIST targets AI agent identity as perimeter model fades
The NCCoE's six AI-cyber projects and its agent identity concept paper are building the governance framework for a perimeter-less world that most agencies still haven't acknowledged they're living in.
NIST's NCCoE is running six projects at the AI-cybersecurity intersection, and the agency's February concept paper on software and AI agent identity and authorization laid out the scaffolding for governing what AI agents can access and do. The argument that perimeter-based federal security is obsolete isn't new, but NIST's standards work confirms the government's own technical body is building the replacement. The gap isn't diagnosis; it's whether agency CISOs have moved their architectures to match.
THU
trade-press
NIST opens public comment on first storage-infrastructure security guide update since 2020
The draft adds new control families for storage-specific threats, closing a four-year gap in the guidance covering the least-secured pillar of IT infrastructure.
NIST released an initial public draft of SP 800-209 Revision 1, updating its storage infrastructure security guidelines for the first time since 2020. The revision adds new security control families and expands threat modeling to address platform compromise and data resilience risks specific to storage systems. Assessors, C3PAOs, contractors, and MSPs that manage storage infrastructure will need to evaluate revised criteria. Comments close September 8.
THU
trade-press
Secure AI Development Act would mandate NSA frontier-model testing
The proposal turns frontier-model review from voluntary benchmarking into a federal release gate, with the definition doing most of the work.
Sen. Mark Warner introduced a six-bill AI framework that includes the Secure AI Development Act, which would require National Security Agency pre-deployment testing of frontier AI models and add AI-specific risk tracking through CISA’s Common Vulnerabilities and Exposures program and NIST’s National Vulnerability Database. ISVs, contractors, executives and C3PAOs would face a new compliance checkpoint if the bill passes. The unresolved question is the load-bearing one: which models count as “frontier,” and whether work already underway gets pulled into the gate.
WED
trade-press
NIST SP 800-63-4 moves identity into continuous risk management
Agencies now need evidence that proofing, authentication and automated fraud controls keep working after rollout.
The National Institute of Standards and Technology (NIST) SP 800-63-4 moves identity programs into a Digital Identity Risk Management lifecycle, with raised Identity Assurance Level (IAL) expectations and phishing-resistant authentication offered at Authentication Assurance Level (AAL) 2 and mandated at AAL3. Agencies carry the direct rebuild; contractors, assessors and Cybersecurity Maturity Model Certification (CMMC) Third-Party Assessment Organizations (C3PAOs) inherit the evidence problem. The missing piece is schedule: the source does not identify a transition deadline from SP 800-63-3 or alignment with Executive Order 13681.
MON
trade-press
FCC weighs covered-list hardware ban as NIST convenes AI data center workshop
The useful signal is provenance: certification filings and AI facilities now share a supply-chain security problem.
Inside Cybersecurity reports that the Federal Communications Commission will consider a Wednesday order barring authorization for devices with logic-bearing hardware components made by entities on the FCC’s covered list. An attached notice would propose requiring Software Bill of Materials or Hardware Bill of Materials filings at certification. NIST also holds a two-day AI data center workshop on architecture, training, security posture, supply-chain issues and emerging standards. The common demand is evidence about what is inside the stack before anyone calls it secure.
MON
trade-press
NSPM-12 pushes agencies toward NSA-centered cyber assessments
The memo may reduce self-graded security theater, if agencies can reconcile it with the assessment regimes already claiming the field.
A MeriTalk contributed piece from Armis by ServiceNow says National Security Presidential Memorandum 12 elevates federal cybersecurity by putting security assessments and recommendations under the National Manager for National Security Systems, operating under the NSA director. The directive also requires agencies to maintain and annually update inventories of national security systems and urges consistency across civilian and defense organizations. The hard part is not the slogan. It is avoiding another assessment lane agencies must satisfy without clearer criteria.
JUL 10
trade-press
Commentary pitches AI training for federal cyber defenders
The useful point is practical: AI policy does not train incident responders, forensic analysts, or network defenders by itself.
A Federal News Network commentary argues federal agencies need continuing, performance-based cyber training as AI-assisted phishing, reconnaissance and vulnerability analysis reshape federal network defense. It cites Trump administration AI and cyber directives, DoD 8140 and NIST’s NICE Workforce Framework for Cybersecurity, but the operational ask is familiar: train practitioners on realistic scenarios, not just concepts.
JUL 9
trade-press
NIST finalizes SP 800-161 supplier due-diligence guide
SBOM analysis is moving from procurement nice-to-have into the minimum research NIST expects before supplier selection.
Inside Cybersecurity reports that NIST finalized its fourth SP 800-161 quick-start guide, this one for supplier due-diligence assessments. The final guide adds SBOM analytical findings, replaces the draft “Stability” category with “Resilience,” and organizes reviews around five research categories for primes, contractors, subs and assessors. The unresolved question is whether any SBOM clears the foundational-practice bar, or whether format and maturity will matter.
JUL 9
trade-press
DoD fast-tracks CMMC shift to NIST 800-171 Rev. 3
DoD is trying to avoid another CMMC comment-cycle drag, leaving contractors to price work against an unnamed clock.
Inside Cybersecurity reports that the Defense Department’s 2026 unified agenda, published July 3, places an interim final rule in motion to move the Cybersecurity Maturity Model Certification program from National Institute of Standards and Technology Special Publication 800-171 Revision 2 to Revision 3 for controlled unclassified information. Primes, subcontractors and certified third-party assessment organizations get the practical problem: Rev. 2 assessments and contract planning now have an approaching shelf life, but DoD has not said when the clock starts or what happens after it expires.
JUL 8
vendor
AWS ties PQC mandates to algorithm agility
The useful part is the governance model, while the sales pitch treats hard dependencies as future provider problems.
AWS published a CISO playbook for post-quantum cryptography migration built around NIST’s August 2024 ML-KEM, ML-DSA and SLH-DSA standards. It targets executives, state CISOs, primes and contractors facing jurisdiction-specific readiness deadlines and procurement gates. The practical advice is centralized ownership, dependency classification and algorithm telemetry; the gap is enforcement detail, including whether federal contractors face earlier or different deadlines than commercial buyers.
JUL 8
trade-press
Commerce OIG pushes NIST to staff NVD backlog
The vulnerability database is still treated like shared infrastructure, which is exactly how critical systems become nobody’s staffing problem.
Federal News Network reports that a Commerce Office of Inspector General review found NIST’s National Vulnerability Database still needs more resources to work through a vulnerability-analysis backlog that began in 2024. The NVD gets about 300,000 hits a day and feeds defenders’ tools with enriched CVE data, including software-version mappings. NIST has already moved to a risk-based enrichment model, but the audit’s point is simpler: prioritization is not the same thing as capacity.
JUL 8
trade-press
NIST embeds C-SCRM planning in SP 800-18 Rev. 2
The useful part is also the uncomfortable part: supply chain risk is harder to park outside core authorization documentation.
NIST released Special Publication 800-18 Rev. 2, replacing 2006 federal system-security-plan guidance with a three-plan model for security, privacy and cybersecurity supply chain risk management (C-SCRM). Federal agencies, state CISOs tracking NIST-based authorization models, primes and contractors should expect authorization packages to map C-SCRM requirements to NIST Risk Management Framework tasks. What NIST does not specify is the transition clock for existing plans.
JUL 2
trade-press
NIST NCCoE advances Cyber AI Profile, agent identity work
NIST is treating AI as plumbing for cybersecurity programs, which means old control maps will need uncomfortable new seams.
Federal News Network reports that NIST’s National Cybersecurity Center of Excellence is moving six AI-cyber projects, including a summer revision of the Cyber AI Profile and agent identity work that drew comments from more than 600 organizations. Primes, contractors, managed service providers and C3PAOs should read this as early architecture guidance, not certification text. The unresolved question is whether NIST will map existing Cybersecurity Framework, DevSecOps and supply-chain practices tightly enough to change compliance evidence.
JUN 30
regulator
CISA sets IT SSGs for secure software development
CISA can call them voluntary while critical-infrastructure buyers convert the goals into supplier evidence requests.
The Cybersecurity and Infrastructure Security Agency (CISA) released voluntary information technology (IT) Sector Specific Goals (SSGs) on Jan. 7 for secure development, product design and software supply chain risk management. They reach primes, subcontractors, independent software vendors and contractors serving critical infrastructure, with practices covering development-environment separation, trust-relationship monitoring, phishing-resistant multi-factor authentication, secrets management and supply chain risk management. The next 18 months are a procurement story: customer contracts can mandate what CISA frames as voluntary.
JUN 29
regulator
CISA, NSA and NIST push post-quantum cryptography roadmaps
Roadmap language sounds soft until vendors, primes and subs need visibility into quantum-vulnerable cryptography across inherited systems.
The Cybersecurity and Infrastructure Security Agency, National Security Agency and National Institute of Standards and Technology released “Quantum-Readiness: Migration to Post-Quantum Cryptography,” urging early planning before NIST’s first PQC standards, planned for 2024. Critical infrastructure operators, federal contractors, primes, subs and technology vendors are being told to inventory public-key cryptography, engage suppliers and assess reliance on quantum-vulnerable systems. The warning is early, but operationally concrete: without the inventory, no one knows what has to move.
JUN 29
trade-press
NIST finalizes SP 1800-45 for water OT remote access
Its value is practical: remote access stops being a vague policy problem and becomes a control design problem.
NIST finalized Special Publication 1800-45 on June 24, moving a 2024 draft technical note into a National Cybersecurity Center of Excellence practice guide with three remote operational technology (OT) access reference architectures for water and wastewater systems. Municipal technology teams, OT engineers, assessors, and service providers, including internet service providers, get a concrete model for encryption, multifactor authentication, least privilege and third-party access. The useful shift is from incident response to architecture, where misconfiguration can reach process control and safety systems.
JUN 29
trade-press
NIST opens OT asset management project for comments
The useful part is the premise: zero trust, incident response and vulnerability work all fail when operators cannot inventory the plant.
NIST’s National Cybersecurity Center of Excellence released a draft project description for operational technology asset management and visibility, with comments due July 31. The project would work with asset owners, operators and solution providers on commercially available approaches for discovery, inventory, configuration management and change management. OT teams are the audience, and NIST is starting where many programs still break: asset visibility.
JUN 26
trade-press
House panel advances NIST AI hub and flaw-reporting bills
Congress is turning AI security from executive-branch architecture into statute, while leaving vendors to guess what voluntary reporting buys them.
The House Science Committee advanced two AI bills that would codify the National Institute of Standards and Technology’s AI hub as the Center for AI Security and Innovation and create a voluntary flaw-reporting program at NIST, in consultation with the Cybersecurity and Infrastructure Security Agency. CMMC third-party assessment organizations, independent software vendors and agencies get a clearer federal direction on AI assurance. They do not yet get the hard parts: liability protection, incentives, timelines or enforcement mechanics.
JUN 26
trade-press
White House PQC order turns market edge into FAR requirement
The useful private-sector signal now becomes a procurement filter, which is where federal cyber transitions stop being aspirational.
A June 22 White House executive order moves federal high-value assets and high-impact systems to post-quantum cryptography for key establishment by December 31, 2030, and digital signatures by December 31, 2031, with Federal Acquisition Regulation changes coming for contractors. R Street’s Mark Dalton told Inside Cybersecurity the private-sector race on quantum-safe products can speed the transition, but the hard part is funding agencies and writing contract language that vendors can actually build against.
JUN 25
trade-press
Pentagon sets 2030, 2031 PQC deadlines for contractors
Quantum planning became contract hygiene, and the painful part is the inventory of every module, product and supplier claim.
Inside Cybersecurity reports the Defense Department released a post-quantum cryptography (PQC) strategy requiring all DoD systems to support PQC by Dec. 31, 2030, and use it by Dec. 31, 2031. Executive Order 14409 directs covered federal contractors to meet National Institute of Standards and Technology Federal Information Processing Standards by the 2030 date. For defense-industrial-base primes and subs, the work is inventory, validation and supplier evidence, with missed dependencies carrying contract-compliance, rejection and future-procurement risk. The civilian-agency contractor timeline remains unresolved.
JUN 24
vendor
EO 14409 sets 2030 contractor deadline for post-quantum FIPS
The advisory phase is over, and OMB now has to turn crypto inventory work into procurement evidence.
Executive Order 14409, signed June 22, 2026, gives agencies until Dec. 31, 2030, to move their most sensitive systems to post-quantum cryptography for encryption and until Dec. 31, 2031, for authentication. Federal contractors must meet post-quantum Federal Information Processing Standards by the end of 2030 or risk procurement ineligibility. The hard part is the evidence: the Office of Management and Budget still has to say how compliance gets verified.
JUN 23
trade-press
Trump PQC order compresses contractor deadline to 2030
The operative problem is procurement: vendors now need measurable crypto migration plans before FAR clauses make quantum readiness a bid gate.
President Trump’s executive order requires agencies to move high-value assets and high-impact systems to post-quantum cryptographic keys by Dec. 31, 2030, with PQC digital signatures due by the end of 2031, Federal News Network reports. The Federal Acquisition Regulatory Council must develop rules requiring contractor compliance by Dec. 31, 2030. Primes, subcontractors and C3PAOs now have a procurement problem, not a research horizon: the Biden-era planning target was 2035.
JUN 23
trade-press
Trump orders agencies into post-quantum cryptography transition
The mandate turns years of NIST migration planning into procurement pressure, while leaving agencies to find the deadlines and money.
Trump’s executive order directs federal agencies to move toward post-quantum cryptography for classified and sensitive data, shifting PQC from NIST guidance into binding executive policy. Primes, contractors, managed service providers and agencies now face inventory, testing and replacement work across cryptographic products. The order’s weak spot is familiar: it starts the migration without specifying implementation deadlines, funding or enforcement for missed milestones.
JUN 23
trade-press
Trump mandates post-quantum cryptography migration by 2030-31
The threat model just became a procurement clock, with contractors facing deadlines for standards NIST only finalized in 2024.
Trump signed two executive orders Monday, Nextgov/FCW reports: one directs federal cryptography toward post-quantum cryptography, with key establishment updated by 2030 and digital signatures by 2031 in critical infrastructure and high-impact environments; the other creates a Department of Energy quantum-computing development effort. Agencies, primes, covered contractors and Cybersecurity Maturity Model Certification Third-Party Assessment Organizations now have to turn cryptographic inventories into budgets and contract language. Procurement timing remains the live question for solicitations issued before 2030.
JUN 22
trade-press
Trump PQC order accelerates agency, contractor migration
Procurement is where voluntary cryptography guidance becomes real, even if the White House still has not shown the clock.
CyberScoop reports the Trump administration will order federal agencies and vendors to accelerate migration to National Institute of Standards and Technology post-quantum cryptography standards. Primes, subs and federal buyers should expect PQC readiness to move from planning document to procurement screen, with noncompliance potentially affecting future federal work. The missing pieces are the ones contractors need most: the deadline, phase-in model and enforcement mechanism.
JUN 22
trade-press
NIST shifts SP 800-213 toward IoT products
The draft treats IoT as an interdependent product stack, which is where agency risk already lived outside the 2021 framing.
NIST plans to release a June 24 draft revision to Special Publication 800-213, moving federal Internet of Things cybersecurity guidance from device-centered requirements toward IoT products with external software, services and connected components. Federal agencies are the direct audience, with state CISOs, managed service providers and C3PAOs likely watching the procurement and assessment language. The practical question is whether agencies must revisit existing 2021-era deployments or only apply the revision going forward.
JUN 22
trade-press
White House readies quantum counterintelligence executive order
The order treats quantum labs, university researchers and vendors as espionage surfaces before cryptography migration becomes the easy part.
Nextgov/FCW reports that a pending executive order expected this week would direct the FBI and intelligence agencies to harden U.S. quantum research against foreign spying and accelerate post-quantum cryptography migration. Federal labs, defense contractors, universities and C3PAOs should watch for personnel security, insider-threat and vendor-review requirements. The unresolved piece is whether those obligations land as binding contractor terms or advisory guidance.
JUN 22
trade-press
CNAS presses NIST’s CAISI for 72-hour Chinese AI reviews
The useful question is whether Commerce can publish warnings before enterprises and researchers normalize the models.
Inside Cybersecurity reports that the Center for a New American Security urged Commerce to direct NIST’s Center for AI Standards and Innovation to publish national security assessments of Chinese frontier AI models within 72 hours of release, with classified or confidential material to agencies and allies within 96 hours. CNAS wants $10 million to $20 million annually for the mission; a House fiscal 2027 NIST bill includes $15 million. The point is speed: warnings after adoption mostly document the damage.
JUN 16
trade-press
NSPM-12 puts National Security Systems cloud policy on 90-day clock
The memo ties inventory, cloud authorization and NSA oversight together, which turns stale system maps into compliance exposure.
A NextGov commentary says NSPM-12 gives federal agencies 90 days to update cloud-security policy for National Security Systems (NSS), requires annual NSS inventories, and formally designates the National Security Agency as National Manager with assessment authority. Agencies, state CISOs working adjacent federal missions, primes and contractors supporting NSS deployments have to align cloud and AI security patterns to those inventories. The open question is whether legacy-heavy agencies get staged compliance or the same penalty clock.
JUN 15
trade-press
NIST sketches dual-stack PQC path for PIV cards
The useful news is the coexistence model: PIV modernization now looks like a long migration, not a 2035 cliff.
NIST has published preliminary working materials for adding post-quantum cryptography to federal Personal Identity Verification cards, Inside Cybersecurity reports. The drafts update SP 800-73 Parts 1 and 2 and SP 800-78 around FIPS 203 ML-KEM and FIPS 204 ML-DSA. Federal agencies, primes, contractors and CMMC Third-Party Assessment Organizations get an early map for PIV changes, but not a final deployment clock.
JUN 15
trade-press
House appropriators cut CISA below Trump’s request
The House is not just trimming CISA; it is narrowing the agency while still handing it new technical homework.
The House Appropriations Committee advanced the fiscal 2027 Department of Homeland Security spending bill 34-27, cutting the Cybersecurity and Infrastructure Security Agency by $252.7 million to $2.35 billion, Inside Cybersecurity reports. That is $118 million below the Trump administration’s request. Contractors and agencies still get directives on agentic AI identity security, Software Bills of Materials and post-quantum cryptography, which makes the bill’s message fairly clear: less CISA, but not less dependence on CISA.
JUN 12
trade-press
NIST finalizes CSF 2.0 ransomware profile
It turns ransomware readiness into governance evidence for buyers and auditors, but NIST still owes smaller firms the guide previewed in January.
Inside Cybersecurity reports that the National Institute of Standards and Technology finalized a Cybersecurity Framework 2.0 (CSF 2.0) ransomware risk management profile, replacing the 2022 CSF 1.1 version. Primes, contractors, managed service providers and Cybersecurity Maturity Model Certification Third-Party Assessment Organizations now have updated guidance on risk appetite, planning, legal requirements, roles and response responsibilities. The warning is timing: NIST expects misaligned governance structures to become audit material within 18 to 24 months, while its promised small-business guide is still absent.
JUN 12
trade-press
NSM 10 moves agencies into PQC execution
The hard part is cryptographic visibility, where zero-trust-style consensus turns into ownership fights, inventory gaps and validation risk.
A Federal News Network commentary by Forescout’s Alison King says post-quantum cryptography (PQC) readiness has crossed from standards work into execution under National Security Memorandum 10. Federal agencies, state CISOs, primes and contractors now need cryptographic inventories, migration sequencing and validation across legacy, mission-critical systems. The zero-trust lesson is practical: agreement without ownership leaves hidden dependencies untouched while dashboards report movement.
JUN 11
trade-press
NIST proof backs continuous AI prompt-injection monitoring
The practical message is ugly but useful: red teams and recovery plans beat one-time assurance claims.
The National Institute of Standards and Technology (NIST) said senior scientist Apostol Vassilev’s peer-reviewed proof, published in IEEE Security and Privacy, shows fixed artificial intelligence guardrails are not universally robust against adaptive adversarial prompts. Developers and organizations deploying AI systems should fund red-team prompt discovery, continuous guardrail updates and resilience planning. The proof demotes prompt-injection security from product claim to operating discipline.
JUN 11
trade-press
Army shifts zero trust from compliance to continuous monitoring
The slogan is familiar; the operational test is whether controls protect data without slowing tactical units.
Federal News Network reports that Matt McDougall, G-6 senior technical advisor for U.S. Army Western Hemisphere Command, described Army zero trust as a move away from manual cybersecurity compliance toward continuous monitoring and controls built into systems as they deploy. The affected users are service members and tactical organizations operating in degraded or targeted networks. The actual work is data mapping, AI-assisted anomaly detection and human validation, which is harder than a cleaner acronym slide.
JUN 10
trade-press
SIIA pushes federal PQC migration strategy before 2035
Algorithm selection is no longer the hard part; the expensive work is finding where old federal systems quietly depend on it.
The Software & Information Industry Association released a June 9 report urging a federal post-quantum cryptography migration strategy and more cybersecurity infrastructure investment. Primes, contractors, state CISOs and C3PAOs should read the ask as a planning signal, not a procurement shortcut. NIST finalized PQC algorithms in August 2024, and federal systems face a 2035 transition goal, but SIIA’s real complaint is legacy architecture: systems built over decades cannot simply swap in new cryptography.
JUN 10
trade-press
House NDAA amendment targets CMMC cost burden
Congress is no longer just watching CMMC rollout mechanics; it is asking whether the market structure is pricing out small suppliers.
Inside Cybersecurity reports that House Armed Services advanced the fiscal 2027 National Defense Authorization Act, 44-12, with a Rep. Jeff Crank amendment requesting a Defense Department briefing on Cybersecurity Maturity Model Certification reforms by March 1, 2027. The amendment cites excessive regulatory burdens, small-business disadvantage, and fee transparency concerns involving the Cyber AB and CMMC Third-Party Assessment Organizations. Primes, subs, assessors, and the Cyber AB get the message: CMMC cost is now a Hill oversight target.
JUN 5
trade-press
Great American AI Act draft codifies NIST AI center
The sharper move is federal preemption: states would lose frontier-model development authority while keeping the messier post-deployment fights.
FedScoop reports that the bipartisan Great American AI Act discussion draft would codify the National Institute of Standards and Technology’s Center for AI Standards and Innovation and authorize $100 million annually for fiscal 2027 through 2029. It also would preempt state frontier-AI development rules while allowing post-deployment and general-applicability laws. Federal primes, large frontier-model developers and state chief information security officers get a split map: federal standards and incident reporting for frontier development, state oversight after deployment. The missing trigger is practical: which critical safety incidents force reporting to government.
JUN 4
trade-press
Trump EO narrows frontier AI cyber review to 30 days
The administration wants a federal look at dangerous cyber capability without accepting the delay that meaningful review usually requires.
Federal News Network reports that Trump’s AI executive order directs NIST, NSA and CISA to build a voluntary review process for frontier AI models with cybersecurity capabilities within 60 days. Developers would give the government 30 calendar days of pre-release access, but the order bars using the language to require pre-clearance. ISVs, defense-industrial-base suppliers, executives and C3PAOs get a planning problem: a classified threshold process will decide which models represent a “meaningful step-change,” while refusal carries no stated consequence.
JUN 2
trade-press
Trump AI order narrows model access to 30 days
The White House kept a deployment-gate view of frontier models, then stripped out the part industry feared most.
Nextgov/FCW reports that President Trump signed a cybersecurity-focused AI executive order requiring agencies to secure Defense Department, national security and civilian networks within 30 days. It also starts a 60-day process, led by the National Security Agency with NIST, CISA and others, to create classified benchmarking for “covered frontier models.” The pre-public model access window fell from an earlier 90-day draft to 30 days, and the order bars licensing or preclearance requirements.
JUN 2
trade-press
Commerce IG faults NIST on 27,000-vulnerability NVD backlog
The database agencies automate around is now the bottleneck, and another watchdog has put a date on the capacity problem.
The Commerce Department inspector general found that NIST lacks sustainable processes for the National Vulnerability Database and cannot clear a 27,000-plus vulnerability backlog without significant changes. Federal agencies, primes, contractors and managed service providers that depend on NVD enrichment for automated vulnerability management face continued delays. The backlog has doubled since May 2024, and reported vulnerabilities are projected to top 60,000 annually in 2026.
JUN 1
trade-press
NIST adds CISA SSVC data to NVD starting June 17
With full enrichment capped at 15, 20 percent of new CVEs, the exploitation-status data landing June 17 covers a fraction of what assessors actually need to triage.
NIST will surface Stakeholder-Specific Vulnerability Categorization data from CISA in the National Vulnerability Database on June 17, adding exploitation status and safety-impact signals alongside existing CVSS scores. The addition follows NIST's April 15 decision to limit full enrichment to CVEs in the Known Exploited Vulnerabilities catalog, federal software, and "critical software" under a Biden-era executive order (roughly 15) 20 percent of new CVEs. Assessors and patch managers at contractors, MSPs, and state agencies relying on NVD for remediation decisions will still face gaps on the remaining 80, 85 percent and will need external intelligence platforms to cover them.
MAY 29
trade-press
House FY2027 NDAA orders DoD cyber-governance review for single accountability
Until DoD names one official responsible for network security, contractors have no stable compliance target for CMMC and 800-171 refresh cycles locking in now.
The House FY2027 NDAA, set for a June 4 markup, would direct the Secretary of Defense to review and potentially consolidate cyber responsibilities across the DoD Chief Information Officer, the Assistant Secretary for Cyber Policy, the Principal Cyber Advisor, U.S. Cyber Command, and DoD Cyber Defense Command. The goal is a single designated official accountable for DoD information-network security, with authority to reassign personnel and eliminate duplicative functions. For defense contractors, that consolidation determines which office owns CMMC compliance enforcement, supply-chain audit authority, and incident-reporting chains. This is the fourth consecutive NDAA to address the same fragmentation problem.
MAY 28
trade-press
NY DFS issues frontier AI cyber advisory ahead of federal frameworks
NY DFS Part 500 entities face accelerated vulnerability management timelines now, not after federal rulemaking catches up.
New York DFS published a May 21 advisory urging Part 500-regulated financial entities to strengthen cybersecurity posture against frontier AI-enabled threat actors. The advisory imposes no new legal requirements but signals regulatory expectations: expedited vulnerability identification and remediation, dependency mapping for third-party service providers, and heightened monitoring. NY DFS explicitly says regulated entities should reassess whether current vulnerability management timelines are fast enough given AI-accelerated exploitation. Federal agencies have not yet issued comparable guidance on frontier AI risks.
MAY 26