# Bounded coverage waiver: ENISA EUVD feed (SRC-017) not retrievable from the run environment

- **Artifact ID:** CHQ-WAIVER-2026-001
- **Version:** 1.0
- **Status:** IN FORCE
- **Public record:** https://record.cybersecurityhq.com/governance/chq-waiver-2026-001
- **Machine-record SHA-256:** `47dfcbd6276c328ea3809851bef9c65feb0ddeb2b718c33c720f883439e7ece4`

## Complete structured record

```json
{
  "id": "CHQ-WAIVER-2026-001",
  "title": "Bounded coverage waiver: ENISA EUVD feed (SRC-017) not retrievable from the run environment",
  "class": "COLLECTION_FINDING",
  "version": "1.0",
  "effective": "2026-10-22",
  "published": "2026-10-27",
  "status": "IN FORCE",
  "status_detail": "WAIVED; expires 2026-11-02 (Issue 45 cutoff); renewable once only with a recorded allowlist attempt",
  "rule": "Bounded coverage waiver: ENISA EUVD feed (SRC-017) not retrievable from the run environment",
  "scope": "Coverage limitation: exploited-vulnerability entries that appear only in the EU catalog and not in the CISA catalog are not seen by CHQ during the waiver; every issue published under the waiver states this in Section G. Justification: the fix (egress allowlist, CHQ-EGRESS-REQ-2026-001) is an administrative setting outside the run environment; eight runs without the feed have produced no identified missed entry, which is not evidence that none was missed. Scope: SRC-017 only; EDGAR is not waived (Friday pass remains a recorded gap).",
  "authority": "DM delegated, ratified 2026-10-22"
}
```