vulnerability information
163575·updated Sep 1, 2026Actionable intelligence about identified weaknesses in systems, products, or processes — encompassing details such as flaw descriptions, severity ratings, affected components, and steps needed to exploit or remediate the weakness. Authority documents across the field treat it as a broad input category to risk management: NIST SP 800-53 repeatedly pairs it with threat information as a refined input that "facilitates the selection of additional security controls" and as a basis to "appropriately modify the controls based on… known threat and vulnerability information." CIS Controls likewise directs defenders to "monitor public and private industry sources for new threats and vulnerability information" as a continuous feed into vulnerability management. At its most specific, NIST's CSRC glossary also recognizes a narrower subtype — *technical* vulnerability information — defined as a "detailed description of a weakness to include the implementable steps… necessary to exploit that weakness," confirming that the broader expression subsumes multiple levels of detail, from high-level advisories through full exploitation guidance.
Source
includes threat and vulnerability information, filtering rules for routers or firewalls, configuration parameters forthe sentence this term was read in
generalized from a web lookup of the quoted expression at proposal time Verdict: compositional.
- NIST SP 800-53 Revision 3, Recommended Security ...
- CIS Control 7: Continuous Vulnerability Management - CIS Controls Assessment Specification for Controls v8.1
- technical vulnerability information - Glossary | CSRC
A definition generalized from search results is a draft to react to, not provenance. Confirm it against an authority document before this term is verified.
A web lookup ran when this term was proposed
Actionable intelligence about weaknesses in systems, procedures, internal controls, or implementations — covering identity, severity, exploitability, and remediation guidance — that security and risk professionals collect, share, and act upon to reduce exposure. It is distinguished from the bare fact of a vulnerability's existence by its operational character: it includes the context (affected components, attack vectors, CVSS scores, patch or configuration details) that enables defenders to prioritize and respond. In its most precise authoritative usage (CNSSI 4009-2015 as reflected in the NIST CSRC Glossary), the narrower sub-category "technical vulnerability information" is defined as a "detailed description of a weakness to include the implementable steps (such as code) necessary to exploit that weakness," illustrating how the broader expression encompasses structured, decision-relevant data rather than just an abstract label. Across NIST guidance, "threat and vulnerability information" collected during risk assessments feeds control selection and supplementation decisions, confirming that the expression names a class of intelligence inputs to risk management rather than a parti
Advisory only. A term this product ships is defined by an authority document, not by a search result.
Proposed during multiword review of this document in the CKI mapping queue.
Attested in
Classifications
Entity Type
Sensitivity
Information Class
Variants
- plural
- vulnerability informations
- possessive
- vulnerability information's
- pluralpossessive
- vulnerability informations'
Framework definitions
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 2 citations in that document; a definition is pending curation.Increment 2: attested in 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- Actionable intelligence about identified weaknesses in systems, products, or processes — encompassing details such as flaw descriptions, severity ratings, affected components, and steps needed to exploit or remediate the weakness. Authority documents across the field treat it as a broad input category to risk management: NIST SP 800-53 repeatedly pairs it with threat information as a refined input that "facilitates the selection of additional security controls" and as a basis to "appropriately modify the controls based on… known threat and vulnerability information." CIS Controls likewise directs defenders to "monitor public and private industry sources for new threats and vulnerability information" as a continuous feed into vulnerability management. At its most specific, NIST's CSRC glossary also recognizes a narrower subtype — *technical* vulnerability information — defined as a "detailed description of a weakness to include the implementable steps… necessary to exploit that weakness," confirming that the broader expression subsumes multiple levels of detail, from high-level advisories through full exploitation guidance.DR-088 backfill from the noun definition column