DHS: 2019 MITRE CVE Budget

To Whom It May Concern:

Pursuant to the Freedom of Information Act, I hereby request the following records:

The amount of money provided by DHS to MITRE to fund the "Common Vulnerabilities & Exposures" (CVE) project (reference: https://cve.mitre.org/) for the 2019 calendar year. This includes personnel, materials, computers, and applicable expenditures such as travel.

If CVE is part of a larger contract that funds multiple projects, the total amount provided for that contract with any details that explains the amount of that funding that goes toward CVE, including a copy of the contract governing this project.

The requested documents will be made available to the general public, and this request is not being made for commercial purposes.

In the event that there are fees, I would be grateful if you would inform me of the total charges in advance of fulfilling my request. I would prefer the request filled electronically, by e-mail attachment if available or CD-ROM if not.

Thank you in advance for your anticipated cooperation in this matter. I look forward to receiving your response to this request within 20 business days, as the statute requires.

Sincerely,

Brian Martin

DHS,

I believe I found the contract number for the 2019 fiscal year: HAHQDC17J00070 [1]. Please note that DHS not include a line-item budget item for the CVE project, as noted by the House of Representatives Committee on Energy and Commerce [2]. Per my prior reference [3], MITRE's CVE project only says it is sponsored by "U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA)". MITRE does not appear to make the contract number available on their web site and does not list their current sponsor contact, making this difficult. DHS / CISA employee Jay Gazlay is on the CVE Board [4] and has intimate knowledge of the program, which should help pinpoint where this request is best routed.

Hopefully this gives more precision in the request.

Thank you,

Brian Martin

[1] https://www.dhs.gov/sites/default/files/publications/National%20Protection%20and%20Programs%20Directorate.pdf
[2] https://republicans-energycommerce.house.gov/wp-content/uploads/2018/08/082718-MITRE-Recommendations-for-CVE-Program.pdf
[3] https://cve.mitre.org/community/sponsor.html
[4] https://cve.mitre.org/community/board/index.html#current_members

DHS,

That is the only contract number that I could find and I provided the reference for it. If that does not return anything, does "Cybersecurity and Infrastructure Security Agency (CISA)" help to route the request? That is the department/agency that funds the CVE project. Specifically, DHS employee Jay Gazlay should have knowledge of the contract and be able to provide a contract number.

Thank you,

Brian