Skip to content
You can now search across every topic, entity and event.What's new
NIST
OrganisationUS

NIST

US federal standards body maintaining vulnerability scoring (CVSS), CVE enrichment and SBOM frameworks relied on by private-sector security programmes.

Last refreshed: 17 May 2026 · Appears in 1 active topic

Key Question

What happens to enterprise patch triage if NIST's vulnerability database funding is cut?

Timeline for NIST

#810 Jun

Mentioned in: CISA tears up its KEV deadline rules

Cybersecurity: Threats and Defences
#61 Jun

Mentioned in: WebLogic flaw revived as ransomware vector

Cybersecurity: Threats and Defences
#519 May

Mentioned in: Germany pays maintainers to staff IETF and W3C

European Tech Sovereignty
#114 Apr

Mentioned in: 17-year-old Office RCE back on KEV

Cybersecurity: Threats and Defences
#17 Apr

Trump proposes $707m CISA cut, 860 jobs

Cybersecurity: Threats and Defences
View full timeline →
Follow Cybersecurity: Threats and Defences →
Common Questions
What is NIST and what does it have to do with cybersecurity?
NIST is the US National Institute of Standards and Technology. In cybersecurity it maintains the CVE enrichment programme, CVSS vulnerability scoring, and the SBOM framework that companies use to track software component risk.Source: nist.gov
Is NIST being defunded under Trump?
Yes. A 2026 budget proposal included a $707m cut to CISA and significant reductions to NIST programmes, prompting concerns in the EU and private sector about whether US-maintained vulnerability databases and scoring standards remain reliable.Source: event
Why does Europe care about NIST standards if it is a US agency?
NIST standards underpin the software supply chain globally. The NVD vulnerability database, SBOM specifications, and CVSS scores are used by European companies and regulators. Cuts to NIST directly affect EU Cyber Resilience Act compliance tooling that references NVD data.Source: nist.gov

Background

The National Institute of Standards and Technology (NIST) maintains the vulnerability-scoring standards, CVE enrichment and Software Bill of Materials (SBOM) frameworks that underpin private-sector patch-triage decisions. Under the Trump FY27 budget proposal, NIST is inside the broader cuts envelope affecting federal Science and standards agencies, raising concerns about continuity of the NVD (National Vulnerability Database) and SBOM guidance programmes relied on by enterprise security teams.

NIST's Cybersecurity Framework (CSF) is the primary voluntary standard used by US critical infrastructure operators. The National Vulnerability Database, which NIST maintains, provides the CVSS scoring and CVE enrichment data that security tools, patch management platforms and GRC systems ingest daily. SBOM guidance published by NIST forms the backbone of software supply-chain transparency requirements now appearing in federal procurement rules.

For enterprise security teams, any reduction in NVD staffing or SBOM programme output would create a gap in the data pipelines that drive automated patch prioritisation. The CVSS scoring that distinguishes a 9.8 RCE from a medium-severity DoS — a distinction that matters operationally, as the F5 reclassification demonstrated — depends on sustained NIST resourcing.