EU and U.S. Efforts Aim to Strengthen CVE Program Governance
Summary
EU member states tasked ENISA with exploring ways to strengthen the CVE program after a brief MITRE contract renewal delay exposed reliance on one U.S. government contract. U.S. lawmakers are also drafting governance legislation.
Key points
- EU member states tasked ENISA with exploring ways to strengthen and modernize the CVE program and diversify its support.
- A brief contract renewal delay in April 2025 exposed the program’s reliance on a single U.S. government contract; CISA said operations continued without disruption.
- U.S. congressional staff are drafting legislation to formalize the program and clarify CISA’s oversight responsibilities.
- The proposed U.S. approach would seek to protect CVE board membership from political cycles.
- Experts say vulnerability records need higher-quality, machine-readable information at issuance, rather than relying on later enrichment, as attacks accelerate.
- MITRE remains the CVE program operator, and CISA and DHS have implemented measures intended to support continuity.
Article Details
- Event Type
- The EU is moving to strengthen and diversify support for the Common Vulnerabilities and Exposures (CVE) Program after a brief funding-renewal delay involving MITRE prompted concerns about the program’s governance and reliance on a single U.S. government contract. U.S. congressional staff are also drafting legislation to formalize the program’s structure and oversight.
- Impact
- The April 2025 renewal delay was resolved within hours, and CISA said operations continued without disruption. The episode highlighted continuity and governance risks. EU member states tasked ENISA with exploring ways to strengthen the program, while U.S. authorities implemented continuity measures. Experts also called for higher-quality, machine-readable vulnerability records at issuance to help defenders keep pace with AI-accelerated attacks.
People
Bob LordFormer CISA official involved in the Secure by Design initiative; advocated for high-quality, machine-readable CVE records at issuance.Hans de VriesCybersecurity and operational chief at ENISA; discussed the EU’s intent to support and modernize the CVE Program and ensure its continuity.Moira BerginLeads cyber policy work for Democratic members of the House Homeland Security Committee; discussed proposed legislation and accountability concerns regarding CISA’s role in the CVE Program.