CISA Releases Framework for the CVE Program’s Holistic Shift into a New Quality Era

09/23/2026 11:00AM EST

The Common Vulnerabilities and Exposures (CVE) Program is the global standard for vulnerability identification and is a widely trusted public good. Today, the Cybersecurity and Infrastructure Security Agency (CISA) released a new white paper, CVE Program: Establishing a Quality Era Framework, that introduces four dimensions of quality and explains how they align with the six lines of effort outlined in CISA’s Strategic Focus on CVE Quality for a Cyber Secure Future, published last year.

With new CVE Numbering Authorities and Roots joining the program from around the world, and automated and AI enabled technologies introducing new pressures across the software development lifecycle, CISA recognized the need for a holistic maturation effort to transition the program from its growth period to a new Quality Era. This transition paves the way for the CVE Program to respond to the pressures and challenges facing the CVE ecosystem and to continue meeting the cybersecurity community’s needs through a refocused lens on reliability, responsiveness, and data quality.

The framework’s four dimensions include:

1. Program governance that provides transparent and effective governance,
2. Ecosystem participation that includes broad, active, and global community representation,
3. Data infrastructure that is robust and supports core CVE operational functions, and
4. CVE record content that cyber defenders and users can rely on with confidence.

To learn more about how CISA is advancing quality across the CVE program, read the full white paper.