Add Decision Table for NIST CVE enrichment

[ahouseholder]

Describe the solution you'd like

NIST has a decision model embedded in their NIST Updates NVD Operations to Address Record CVE Growth post.

New Prioritization Criteria
Starting on April 15, 2026, we will prioritize the following CVEs for enrichment:
CVEs appearing in CISA’s Known Exploited Vulnerabilities (KEV) Catalog
Our goal is to enrich these within one business day of receipt
CVEs for software used within the federal government
CVEs for critical software as defined by Executive Order 14028
All submitted CVEs will still be added to the NVD. However, those that do not meet the criteria above will be categorized as “Lowest Priority - not scheduled for immediate enrichment.” This will allow us to focus on CVEs with the greatest potential for widespread impact. While CVEs that do not meet these criteria may have a significant impact on affected systems, they generally do not present the same level of systemic risk as those in the prioritized categories.
These criteria may not catch every potentially high-impact CVE. Therefore, users can request enrichment of any lowest priority CVEs by emailing us at nvd@nist.gov. We will review those requests and schedule the CVEs for enrichment as resources allow.
A full definition of critical software and a description of our new workflow, including how we will order our processing queue, is available on the NVD website.

The last link in that block includes:

NVD Scope of Coverage
NVD enrichment activities intend to address CVEs that have the greatest potential impact on the nation’s cybersecurity. The following CVEs are considered to be part of NVD’s Scope of Coverage:

• CVEs appearing in CISA’s Known Exploited Vulnerabilities (KEV) Catalog.
  • Within one business day of addition to the KEV Catalog
• CVEs for software used within the federal government
• CVEs for Critical Software as defined by Executive Order 14028

It goes on to clarify:

EO Order 14028 Critical software is defined as any software that has direct software dependencies (and one or more components with at least one of these attributes):

• It is designed to run with elevated privilege or managed privileges
• It has direct or privileged access to networking or computing resources
• It is designed to control access to data or operational technology
• It performs a critical function to trust, or it operates outside of normal trust boundaries with privileged access

What we want here:

Create an SSVC Decision Table from:

• CISA:InKev
• (new?) SW In use by USG
  • which namespace to use? nist or cisa?
  • do we make this a generic ssvc decision point for "sw in scope" and then make a nist refinement that fine tunes it into sw in use by USG? This seems like what the namespacing extensions were built for.
• an extension of the Critical Software decision point to specifically make it EO 14028 relevant. I don't think we need to build a decision model for EO 14028 separately, although we could consider that as an add-on with four likely new binary decision points to match the EO criteria: "privileges: elevated"/"access:privileges"/"access control:data or OT"/"trust-critical" (we would need to design these. My suggestion would be that this issue only address the NIST decision table, and an EO 14028 decision table would spawn a separate issue.

Open questions include:

• What is the outcome set? Is it just "enrich / don't enrich"? or "enrichment priority: low / high" or something more granular?

[laurie-tyz]

NIST Internal Security Team (IST) CVE Prioritization

IST will prioritize the following CVEs for enrichment:

1. CVEs appearing in CISA’s Known Exploited Vulnerabilities (KEV) Catalog
2. CVEs for software used within the federal government
3. CVEs for critical software as defined by Executive Order 14028

There may be overlap across all three categories, but consider the list prioritized in this order:

• In KEV ~ Exploitation: Active
• In USG ~Mission Impact: High
• In Critical Software ~ Technical Impact: High/Very High

How will SSVC know if the software is in USG?

- In KEV:
Can be determined by searching the KEV site.

- In Critical Software:
Use the Critical Software Definition/Functionality lookup list of critical software types and verify whether the product fits the category.

Does CISA have a list of software in USG?

Identifying software in the USG would imply the existence of a dynamic list of software products, updated by Departments and Agencies.
There is no single master list, but here is a list of lists that collectively represent software used or approved within the federal government:

• GSA SAM.gov – Acquisition center for contracts & software
• FedRAMP Marketplace – Cloud services authorized for USG
• CISA’s OSS Security (OS3) List – Focus on OSS components; includes libraries, frameworks, and infrastructure software
• DoD Unified Capabilities Approved Products List (UC APL) and DoDIN Approved Products List (DoDIN APL) – If DoD is in scope
• OMB Federal IT Dashboard – Major IT investments (Oracle ERP, SAP, Microsoft 365, ServiceNow)
• Agency-Specific Inventories – Internal inventories maintained by individual agencies

[laurie-tyz]

Just a starting point:

Category	Technical Impact	Exposure
Runs/manages privileges	Very High	High
Direct/privileged to networking or computing	Very High	High
Access control to data or OT	Very High	High
Critical trust or privileged access outside of normal trust boundaries	High	High

[laurie-tyz]

Critical Software Attribute	Exploitation	Technical Impact	Mission Impact	Public Safety Impact	Exposure	IST Priority Alignment
Runs or manages privileges	High – privilege-escalation targets are frequently exploited	Very High – compromise breaks authentication/authorization boundaries	Very High – enables lateral movement across USG systems	Medium/High – depends on agency mission	High – often network-accessible	Critical Software → High Priority
Direct or privileged access to networking or computing resources	High – network-control components are common KEV entries	Very High – compromise enables traffic manipulation or system control	High – affects communications, routing, and infrastructure	Medium – impacts critical services	High – often externally reachable	Critical Software → High Priority
Controls access to data or operational technology (OT)	Medium/High – targeted for data theft or OT disruption	Very High – compromise exposes sensitive data or OT systems	High – affects mission-critical operations	High – OT failures can affect safety	Medium/High – depends on deployment	Critical Software → High Priority
Critical trust function or privileged access outside normal trust boundaries	Medium/High – targeted by advanced actors	High – compromise undermines trust anchors	High – affects secure operations and system integrity	Medium – depends on system role	High – privileged components often exposed	Critical Software → High Priority

[laurie-tyz]

Does a table make sense or should one yes == Priority is High?

Critical Software Attribute Impact Matrix

Category	Runs or Manages Privileges	Direct / Privileged Access to Networking or Computing Resources	Controls Access to Data or OT	Critical Trust Function or Privileged Access Outside Normal Trust Boundaries
Exploitation – Yes	High – privilege-escalation targets are frequently exploited	High – network-control components are common KEV entries	Medium/High – targeted for data theft or OT disruption	Medium/High – targeted by advanced actors
Exploitation – No	None	None	None	None
Technical Impact – Complete	Very High – compromise breaks authentication/authorization boundaries	Very High – compromise enables traffic manipulation or system control	Very High – compromise exposes sensitive data or OT systems	High – compromise undermines trust anchors
Technical Impact – Partial	None	None	None	None
Mission Impact – Complete	Very High – enables lateral movement across USG systems	High – affects communications, routing, and infrastructure	High – affects mission-critical operations	High – affects secure operations and system integrity
Mission Impact – Minimal	None	None	None	None
Public Safety Impact – Yes	Medium/High – depends on agency mission	Medium – impacts critical services	High – OT failures can affect safety	Medium – depends on system role
Public Safety Impact – No	None	None	None	None
Exposure – Partial/Full	High – often network-accessible	High – often externally reachable	Medium/High – depends on deployment	High – privileged components often exposed
Exposure – None	None	None	None	None
Immediate Action	High Priority	High Priority	High Priority	High Priority
Track	None	None	None	None