We’re Tracking the Future of Security

Category: Standards Watch

  • CISA Sets Four-Dimension Quality Framework for the CVE Program

    CISA Sets Four-Dimension Quality Framework for the CVE Program

    The U.S. Cybersecurity and Infrastructure Security Agency has published a framework for moving the Common Vulnerabilities and Exposures program into what it calls a new Quality Era. Announced on September 23, the initiative focuses on the reliability and sustainability of the global identifier system used to track publicly disclosed security flaws.

    Four dimensions of CVE quality

    The framework organizes improvement work around four dimensions: transparent program governance, broad ecosystem participation, resilient data infrastructure and trustworthy CVE record content. CISA says the approach builds on its earlier CVE strategy and is intended to give maintainers, CVE Numbering Authorities and users clearer ways to measure progress.

    The timing reflects pressure from a growing international contributor base, expanding software supply chains and AI-assisted development and analysis. Those trends can increase both the volume of vulnerability reports and the demand for records that are complete, timely and useful to defenders. The framework does not replace technical severity scoring or vendor advisories; it addresses the quality of the shared identification and cataloging system that connects those sources.

    What security teams should watch

    Asset and vulnerability-management teams depend on stable identifiers to correlate scanner results, supplier notices and remediation activity. Improvements to record completeness and data infrastructure could make that correlation more dependable, but organizations still need to validate affected versions and remediation guidance against primary vendor sources. SectechMedia follows related operational issues in its cyber-physical security coverage.

    Sources

  • ACCS Publishes Assessment Requirements for ISO Age-Assurance Framework

    ACCS Publishes Assessment Requirements for ISO Age-Assurance Framework

    The Age Check Certification Scheme has published ACCS 1:2026, a set of conformity-assessment requirements linked to ISO/IEC 27566-1, the framework for age-assurance systems. The organization says the document is intended to help conformity-assessment bodies prepare for accreditation and certification work covering age verification, estimation and inference services.

    From a framework to assessable controls

    Age-assurance standards describe objectives and system characteristics, but certification also requires a repeatable method for evaluating whether an implementation meets those expectations. ACCS says the new requirements work with its general scheme rules and have been reviewed by the United Kingdom Accreditation Service for suitability in an accreditation process.

    The development comes as regulators and service providers face growing demand for age checks in online environments. Relevant systems can use identity documents, biometrics, account information or other signals, and each method introduces different privacy, security, accessibility and error-handling considerations. A conformity-assessment scheme does not eliminate those trade-offs, but it can give buyers a structured basis for reviewing claims and audit evidence.

    What buyers should verify

    Organizations evaluating age-assurance services should confirm the exact scope of any certification, the version of the referenced standard and whether the assessment covers the deployed configuration rather than only a generic product. They should also examine data minimization, retention, appeal procedures and performance across the intended user population. Marketing language should not be treated as a substitute for a certificate and its scope statement. SectechMedia monitors related requirements through its Standards Watch coverage.

    Sources