specification: FinOps Framework
specificationVersion: '1.0'
schema: https://www.finops.org/framework/
alignedWith:
  framework: FinOps Foundation Framework
  frameworkUrl: https://www.finops.org/framework/
  dataSpec: FOCUS
  dataSpecVersion: '1.3'
  dataSpecUrl: https://focus.finops.org/focus-specification/v1-3/
provider: NVD
providerId: nvd
publisherName: National Institute of Standards and Technology (NIST)
serviceCategory: Public Sector / Security Data
created: '2026-05-04'
# Provenance stamped 2026-08-11: this artifact was written by the API Evangelist
# bulk sweep dated 2026-05-04, not harvested from the provider. See roadmap#35.
method: generated
modified: '2026-05-05'
reconciled: true
tags:
  - Security
  - CVE
  - CPE
  - Vulnerability
  - CVSS
  - FinOps
  - Cost Management
  - FOCUS
description: 'FOCUS-aligned FinOps for the National Vulnerability Database: APIs are free of charge from
  NIST. Cost optimization is about request efficiency (caching, the recommended 6-second sleep, and the
  free API key for 10x throughput) rather than dollars on an invoice.'
sources:
  - https://nvd.nist.gov/developers/start-here
  - https://nvd.nist.gov/developers/request-an-api-key
principles:
  - name: Visibility
    description: NVD does not invoice consumers; visibility is about consumption patterns. Track requests/30s
      against the 5 (anonymous) or 50 (API-keyed) limit and CVE/CPE result counts in client-side telemetry.
  - name: Allocation
    description: Allocate the single shared API key per consuming application or team to keep request
      budgets isolated. Tag downstream uses (vulnerability scanner, SBOM tool, dependency monitor) so
      each owner can see their share of the per-key budget.
  - name: Optimization
    description: Always run with an API key (10x rate limit, free). Cache CVE and CPE responses; use the
      lastModStartDate / lastModEndDate parameters to fetch only deltas instead of the full corpus. Mirror
      to internal storage rather than refetching for every internal scan.
  - name: Accountability
    description: Even though there is no $ cost, throttling impacts consuming product SLAs. Assign an
      owner for the API key and the data refresh pipeline; review monthly for stale or runaway clients.
billingModel:
  pricingCategory: Free / Public Service
  billingFrequency: None
  billingCurrency: USD
  chargeCategories:
    - Usage
  chargeFrequency: None
focusColumns:
  ServiceName: NVD
  ServiceCategory: Public Sector / Security Data
  ProviderName: NIST National Vulnerability Database
  PublisherName: National Institute of Standards and Technology (NIST)
  InvoiceIssuerName: N/A (free service)
  PricingCategory: Free
  PricingUnit: request
  BillingCurrency: USD
  ChargeCategory: Usage
meters:
  - name: api_requests
    description: Total NVD API requests; tracked against the rolling 30-second rate limit
    unit: request
    aggregation: sum
    dimensions:
      - api
      - api_key
      - endpoint
  - name: cve_records_fetched
    description: CVE records returned (used for delta sync planning)
    unit: record
    aggregation: sum
    dimensions:
      - api
  - name: cpe_records_fetched
    description: CPE records returned (used for delta sync planning)
    unit: record
    aggregation: sum
    dimensions:
      - api
apis:
  - name: NVD CVE API
    baseURL: https://services.nvd.nist.gov/rest/json/cves/2.0
    tags:
      - Security
      - CVE
      - Vulnerability
      - CVSS
    serviceName: NVD CVE API
    serviceCategory: Security Data
  - name: NVD CVE Change History API
    baseURL: https://services.nvd.nist.gov/rest/json/cvehistory/2.0
    tags:
      - Security
      - CVE
      - Vulnerability
      - Change History
    serviceName: NVD CVE Change History API
    serviceCategory: Security Data
  - name: NVD CPE API
    baseURL: https://services.nvd.nist.gov/rest/json/cpes/2.0
    tags:
      - Security
      - CPE
      - Product Enumeration
    serviceName: NVD CPE API
    serviceCategory: Security Data
  - name: NVD CPE Match Criteria API
    baseURL: https://services.nvd.nist.gov/rest/json/cpematch/2.0
    tags:
      - Security
      - CPE
      - Match Criteria
    serviceName: NVD CPE Match Criteria API
    serviceCategory: Security Data
  - name: NVD Source API
    baseURL: https://services.nvd.nist.gov/rest/json/source/2.0
    tags:
      - Security
      - Data Sources
      - Organizations
    serviceName: NVD Source API
    serviceCategory: Security Data
unitEconomics:
  - name: Requests per CVE refresh
    metric: api_requests / cve_records_fetched
  - name: Cache hit ratio
    metric: cache_hits / (cache_hits + api_requests)
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com