Federal audit reveals NIST’s NVD is plagued by poor planning and duplication
Commerce IG audit exposes NIST NVD mismanagement, 27K backlog, and duplicate work with CISA.
A Department of Commerce Inspector General report revealed that NIST's National Vulnerability Database has been severely mismanaged due to poor strategic planning, inefficient processes, and lack of coordination with CISA's competing Vulnrichment program. The audit found a backlog of over 27,000 unprocessed security flaws, with analysts spending 80% of their time on redundant tasks like severity scoring that matched independent evaluators only 12% of the time. The report identified at least 21,000 cases of duplicated work between the two federal programs from May 2024 to December 2025, wasting approximately $200,000.
AI summary of the linked source. Not reviewed by an editor. How this works
Run NIST?
Get an email when a new story names NIST, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonNIST's National Vulnerability Database suffered from fundamental management failures including lack of strategic planning, inefficient processes, and poor coordination with other federal programs. The resulting 27,000 vulnerability backlog and 80% time waste on redundant tasks demonstrates how operational dysfunction can severely impact critical cybersecurity infrastructure. When the primary source for vulnerability intelligence fails to function effectively, it creates cascading risks across all organizations that depend on timely and accurate vulnerability data for their security programs.