- CISA’s framework covers governance, participation, data infrastructure and CVE record information
- The agency wants broader involvement from the global cybersecurity community as the CVE Program expands
- CISA is seeking transparent program management to support the evolving vulnerability ecosystem
The Cybersecurity and Infrastructure Security Agency has outlined its strategy for moving the Common Vulnerabilities and Exposures Program from its growth era into a new phase called the quality era.
CISA said Wednesday its document, “CVE Program: Establishing a Quality Era Framework,” provides details on how the agency intends to implement the strategy it published last year for the program, which serves as the global standard for identifying vulnerabilities. The strategy sets out six lines of effort for the transition.
Department of Homeland Security Deputy Secretary Troy Edgar will join CISA Acting Deputy Chief Technology Officer Lauren Wind at the 2026 Homeland Security Summit on Nov. 10, where DHS and industry leaders will discuss emerging security priorities. Save your seat today.
What Changes Does CISA Envision?
The whitepaper covers four areas of the program: governance, ecosystem participation, data infrastructure and vulnerability record content. The document calls for program governance to be transparent and effective and for participation to reflect a wide, engaged and global community. It also calls for data infrastructure strong enough to support core CVE operations and for vulnerability records that cyber defenders and other users can trust.
Why Is CISA Shifting to a Quality Era?
CISA said the CVE program needs to keep adapting as more CVE Numbering Authorities and Roots sign on from around the globe. The agency also pointed to the strain that AI-enabled technologies are putting on the software life cycle.
Chris Butera, acting executive assistant director for cybersecurity at CISA, said the whitepaper reflects input from the CVE community. He described it as part of CISA’s work to strengthen participation and governance. Butera noted the agency has run the program for more than 25 years and asked community members to read the document and share their feedback.
