I spotted this in Dark Reading and wanted to highlight it. The National Vulnerability Database (NVD) operated by NIST has experienced a significant slowdown, leaving many vulnerabilities without essential metadata. This has raised concerns among security experts and enterprise security managers who rely on the NVD for threat information. MITRE, the contractor responsible for CVE collection, has also faced criticism for not addressing the issue. The NVD freeze poses challenges for patching vulnerabilities and may give bad actors more time to exploit enterprise networks.
So, I’ll pair that with coverage about CISA’s budget requests. The Cybersecurity and Infrastructure Security Agency (CISA) is planning to increase staff and implement technology upgrades to support the new cyber incident reporting rules. The agency is requesting a budget of $116 million in fiscal 2025 for the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) program, which includes hiring 122 full-time employees. CISA also aims to roll out significant technology enhancements, such as an unclassified ticketing system and an incident reporting web app. CIRCIA aims to provide earlier insights into cyber attacks on critical infrastructure entities and coordinate responses. The regulations require crucial infrastructure operators to report cyber incidents to CISA within 72 hours.
While I’m covering these moves, The General Services Administration (GSA) has issued a new acquisition letter to make buying cloud services more accessible for agencies. The letter allows contracting officers to use upfront payments for software-as-a-service (SaaS) without violating federal procurement law. The GSA’s changes aim to enhance competition and drive better pricing, mainly benefiting small businesses. However, an amendment to the Anti-Deficiency Act is still needed to allow industry billing in arrears for cloud services on a consumption basis.
Why do we care?
There’s a lot about funding here. If you value their capabilities, NIST and CISA need to be funded. Both of these services are bedrock services for delivering cybersecurity.