Bounded coverage waiver: ENISA EUVD feed (SRC-017) not retrievable from the run environment
Current qualification published in Issue 44 · Issue 43 publication-date report
- id
- CHQ-WAIVER-2026-001
- title
- Bounded coverage waiver: ENISA EUVD feed (SRC-017) not retrievable from the run environment
- class
- COLLECTION_FINDING
- version
- 1.0
- effective
- 2026-10-22
- published
- 2026-10-27
- status
- IN FORCE
- status detail
- WAIVED; expires 2026-11-02 (Issue 45 cutoff); renewable once only with a recorded allowlist attempt
- rule
- Bounded coverage waiver: ENISA EUVD feed (SRC-017) not retrievable from the run environment
- scope
- Coverage limitation: exploited-vulnerability entries that appear only in the EU catalog and not in the CISA catalog are not seen by CHQ during the waiver; every issue published under the waiver states this in Section G. Justification: the fix (egress allowlist, CHQ-EGRESS-REQ-2026-001) is an administrative setting outside the run environment; eight runs without the feed have produced no identified missed entry, which is not evidence that none was missed. Scope: SRC-017 only; EDGAR is not waived (Friday pass remains a recorded gap).
- authority
- DM delegated, ratified 2026-10-22