3 ms·
I tried to look over the history and I only see a funding increase, CISA cut $3.7 million at the end of 2023 for the next year and in response NIST reallocated
by cma 2y ago
I tried to look over the history and I only see a funding increase, CISA cut $3.7 million at the end of 2023 for the next year and in response NIST reallocated extra funding to NVD: $8.5 million in 2024
A funding shortfall and strain isn't a funding cut. And from what I see there was a funding increase.
- transpute 2y agoWould appreciate a pointer to the source, thank you. 2025 article claims 30% increase in 2024 workload, https://www.securityweek.com/mitre-signals-potential-cve-program-deterioration-as-us-gov-funding-expires/ https://www.securityweek.com/mitre-signals-potential-cve-pro... > According to NIST, while the National Vulnerability Database (NVD) is processing incoming CVEs at the same rate as before the slowdown in spring and early summer 2024, a 32 percent jump in submissions last year means that the backlog continues to grow.
- cma 2y agoCan search these for the links 2023 > CISA had previously been supporting the NIST NVD program with approximately $3.7 million per year in interagency funding, which they have discontinued 2024 > While NIST has since reallocated $8.5 million to NVD for fiscal years 2024 and 2025 Assuming that's spread over both years it wasn't as big of an increase as I said, but is still an increase even inflation adjusted. > 2025 article claims 30% increase in 2024 workload Underfunding in the face of more workload isn't itself a funding cut.
- transpute 2y agoThanks for the pointer. Is this a lobbying org? https://www.fdd.org/analysis/policy_briefs/2025/03/21/delayed-vulnerability-analysis-puts-america-at-a-cybersecurity-disadvantage/ https://www.fdd.org/analysis/policy_briefs/2025/03/21/delaye... > While NIST has since reallocated $8.5 million to NVD for fiscal years 2024 and 2025, this funding remains a fraction of the $300 million to $400 million estimated to be needed annually to fully restore capacity, with an additional $120 million to $150 million required to prevent further system “deterioration.” Did NVD receive 300MM annual funding pre-2024? That would be a 98% funding cut.
- formerly_proven 2y ago300 million would’ve been a quarter of the NIST budget. Doubt.
- transpute 2y agoYeah, bizarre site. MITRE CVE/CWE budget is more transparent than NVD since it's a contract, listed on USAspending.gov.