CISA Vulnerability Response Chief Departs Amid CVE Program Continuity Questions

The Cybersecurity and Infrastructure Security Agency (CISA) is facing a leadership transition in vulnerability response as branch chief Lindsey Cerkovnik leaves government service after nearly six years at the agency. Cerkovnik announced her departure in a LinkedIn post and told Nextgov/FCW she plans to begin a new role in mid-November, while declining to identify her next position. CISA has not publicly identified who will assume her responsibilities. Her departure affects a function with a wide operational remit: the office helps oversee the Common Vulnerabilities and Exposures (CVE) Program, industrial-control-system vulnerability work, and coordination related to the Known Exploited Vulnerabilities (KEV) catalog. These activities support the identification, prioritization, disclosure, and remediation of software weaknesses across government and industry.

The transition comes amid broader questions about the continuity and governance of CVE, a system that assigns standardized identifiers to software flaws so researchers, vendors, and governments can refer to the same vulnerabilities. The source reports that CVE is used by virtually all cyber practitioners, including private-sector software developers and analysts within national intelligence agencies. In 2025, the federal contract supporting the program neared expiration. CISA extended it, averting a possible interruption in data flows, but the episode drew attention to how much a globally used resource depends on sustained U.S. support. The reporting does not identify the contractor, contract value, extension terms, or a follow-on acquisition, so it does not establish a current bid opportunity.

For federal contractors, Cerkovnik’s departure is a signal to monitor program continuity and agency priorities, not evidence of an active procurement. Companies with capabilities in vulnerability management, coordinated disclosure, industrial control system security, vulnerability data operations, and remediation support may find it useful to map their offerings to the functions her branch oversees. However, the available reporting names no new solicitation, procurement schedule, replacement official, or specific requirement. The 2025 extension is relevant acquisition history, but it should not be treated as a basis for a bid decision without additional contracting information.

The technical challenge is also evolving. Cerkovnik said at an August panel during the Black Hat cybersecurity conference that CVE could keep pace as researchers discover more flaws, while emphasizing that prioritizing the vulnerabilities that pose the greatest threat is harder than simply tracking a larger volume. “Not all vulnerabilities matter at the same level,” she said. She supported a formal basis for CVE in federal law but cautioned against rigid rules that could constrain responses to emerging cyber threats. AI-assisted vulnerability discovery increases the importance of effective triage, but the source does not report a resulting CISA acquisition or a change in program requirements. Contractors should therefore watch for official statements, budget actions, and procurement notices before drawing conclusions about future work.

• Cerkovnik is leaving CISA after nearly six years and expects to start a new role in mid-November; her next position was not disclosed.
• Cerkovnik joined CISA in May 2021 to lead vulnerability management for industrial control systems and became branch chief in May 2023 after serving as acting chief of the vulnerability response and disclosure section.
• Her responsibilities include work connected to the CVE Program, industrial-control-system vulnerabilities, and the Known Exploited Vulnerabilities catalog; CISA has not announced a successor.
• The CVE Program assigns standardized identifiers to software flaws, enabling researchers, vendors, and governments to track the same vulnerabilities.
• CISA extended the federal contract supporting CVE in 2025 after it neared expiration, averting a possible interruption in data flows; the available reporting gives no contractor name, contract value, or extension details.
• The source identifies no current solicitation or follow-on acquisition, so contractors should treat the contract extension as procurement context rather than an active bid opportunity.
• Cerkovnik said at an August Black Hat panel that CVE could keep pace with rising flaw discovery, while warning that distinguishing urgent threats from less consequential weaknesses is the harder task.
• Cerkovnik supported giving CVE a formal basis in federal law but cautioned that overly rigid rules could hinder responses to emerging cyber threats.
• Contractors can review their alignment with vulnerability triage, coordinated disclosure, industrial control system security, and remediation support, while monitoring official CISA and contracting announcements for actionable requirements.