Federal Audit Finds NIST Wasted Funds With No Plan to Clear NVD Backlog

A Commerce Office of Inspector General audit found NIST lacked a strategic plan for the National Vulnerability Database, missed backlog-reduction targets, duplicated enrichment work with CISA (wasting funds), delayed using CISA enrichment data, and left many CVEs—including some in the Known Exploited Vulnerabilities catalog—unenriched; OIG recommended creating a strategic and backlog-management plan, improving coordination and communications, and reducing redundant processing, and NIST concurred with the recommendations.