vulnerability information
163575·updated Sep 1, 2026Actionable intelligence about identified weaknesses in systems, products, or processes — encompassing details such as flaw descriptions, severity ratings, affected components, and steps needed to exploit or remediate the weakness. Authority documents across the field treat it as a broad input category to risk management: NIST SP 800-53 repeatedly pairs it with threat information as a refined input that "facilitates the selection of additional security controls" and as a basis to "appropriately modify the controls based on… known threat and vulnerability information." CIS Controls likewise directs defenders to "monitor public and private industry sources for new threats and vulnerability information" as a continuous feed into vulnerability management. At its most specific, NIST's CSRC glossary also recognizes a narrower subtype — *technical* vulnerability information — defined as a "detailed description of a weakness to include the implementable steps… necessary to exploit that weakness," confirming that the broader expression subsumes multiple levels of detail, from high-level advisories through full exploitation guidance.
Source
includes threat and vulnerability information, filtering rules for routers or firewalls, configuration parameters forthe sentence this term was read in
generalized from a web lookup of the quoted expression at proposal time Verdict: term of art.
- CIS Critical Security Control 7: Continuous Vulnerability Management
- CIS Control 7: Continuous Vulnerability Management - CIS Controls Assessment Specification for Controls v8.1
- ISO/IEC 30111:2013 - Information technology — Security techniques — Vulnerability handling processes
- Vulnerability Information - an overview | ScienceDirect Topics
- Security Vulnerability Policy - Cisco
- NIST Special Publication 800-53 Revision 1 Recommended Security Controls
- NIST Vulntology
A definition generalized from search results is a draft to react to, not provenance. Confirm it against an authority document before this term is verified.
A web lookup ran when this term was proposed
Actionable intelligence about weaknesses, exposures, and attack conditions in systems, software, or infrastructure that a security program collects, standardizes, and acts upon. It is distinguished from the raw concept of a "vulnerability" by encompassing the full surrounding data set — identifiers (e.g., CVE), severity scores (CVSS), affected platforms, exploitation conditions, remediation guidance, and disclosure timelines — that make a weakness operationally meaningful. In practice, the field produces, exchanges, and consumes it through structured repositories and standards (NVD, CVE, OVAL, SCAP) and through monitored feeds — public and private — that organizations track continuously to drive patching, configuration management, risk assessment, and access-control decisions.
Advisory only. A term this product ships is defined by an authority document, not by a search result.
Proposed during multiword review of this document in the CKI mapping queue.
Attested in
Classifications
Entity Type
Sensitivity
Information Class
Variants
- plural
- vulnerability informations
- possessive
- vulnerability information's
- pluralpossessive
- vulnerability informations'
Framework definitions
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 2 citations in that document; a definition is pending curation.Increment 2: attested in 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- Actionable intelligence about identified weaknesses in systems, products, or processes — encompassing details such as flaw descriptions, severity ratings, affected components, and steps needed to exploit or remediate the weakness. Authority documents across the field treat it as a broad input category to risk management: NIST SP 800-53 repeatedly pairs it with threat information as a refined input that "facilitates the selection of additional security controls" and as a basis to "appropriately modify the controls based on… known threat and vulnerability information." CIS Controls likewise directs defenders to "monitor public and private industry sources for new threats and vulnerability information" as a continuous feed into vulnerability management. At its most specific, NIST's CSRC glossary also recognizes a narrower subtype — *technical* vulnerability information — defined as a "detailed description of a weakness to include the implementable steps… necessary to exploit that weakness," confirming that the broader expression subsumes multiple levels of detail, from high-level advisories through full exploitation guidance.DR-088 backfill from the noun definition column
- §1 · web_lookup_draft
- Actionable intelligence about weaknesses, exposures, and attack conditions in systems, software, or infrastructure that a security program collects, standardizes, and acts upon. It is distinguished from the raw concept of a "vulnerability" by encompassing the full surrounding data set — identifiers (e.g., CVE), severity scores (CVSS), affected platforms, exploitation conditions, remediation guidance, and disclosure timelines — that make a weakness operationally meaningful. In practice, the field produces, exchanges, and consumes it through structured repositories and standards (NVD, CVE, OVAL, SCAP) and through monitored feeds — public and private — that organizations track continuously to drive patching, configuration management, risk assessment, and access-control decisions.Drafted by the propose-term web lookup (PD-018); a curator confirms or replaces it.