# NIST Guides Contractors on NVD Use

NIST’s National Vulnerability Database (NVD) guide explains how to use NVD data for vulnerability assessment, including in security and software bill of materials (SBOM) workflows. The guidance notes that NVD enrichment can be delayed and API access is rate-limited, and recommends checking CISA’s Known Exploited Vulnerabilities (KEV) catalog to prioritize vulnerabilities known to be actively exploited. It is operational guidance, not a new law, appropriation, or federal procurement requirement.

- Contractors can use NVD data to support vulnerability assessment and SBOM processes, while accounting for enrichment delays and API rate limits in their workflows.
- Organizations prioritizing remediation can cross-check NVD findings against CISA’s KEV catalog to identify actively exploited vulnerabilities.
- Procurement teams and contractors should treat the guide as a practical resource, not as a new mandatory contract or compliance requirement.

**Jurisdictions:** federal
**Industries:** Information Technology
**Topics:** Cybersecurity
**Published:** November 08, 2026

### Government Entities
- National Institute of Standards and Technology (NIST)
- Cybersecurity and Infrastructure Security Agency (CISA)
- U.S. Department of Commerce (DOC)
- Information Technology Laboratory (ITL)

### Sources
- [National Vulnerability Database (NVD) Guide — CASRAI](https://casrai.org/guides/nvd) - CASRAI