May 30, 2024·NIST · Special PublicationActiveMedium impact
NIST SP 800-216 - federal CVD recommendations finalized
NIST SP 800-216 finalizes recommendations for federal vulnerability disclosure programs. While federal in scope, MedTech CVD programs are increasingly being benchmarked against it.
What changed
- Defines minimum CVD program elements: intake, triage SLAs, coordination, public advisory cadence.
- Aligns with the FDA's postmarket expectations for a published CVD URL.
Action for manufacturers
Benchmark your CVD policy against SP 800-216; gaps (intake email, triage SLA, advisory template) commonly show up in postmarket update letters.