2026 Mid-Atlantic CISO Policy Roundtable

For more than two decades, the CVE system has served as a foundational coordination mechanism for cybersecurity programs worldwide. Today, that foundation is under strain. Questions of governance, funding, trust, and global legitimacy have placed CVE at an inflection point with real implications for government missions, critical infrastructure, and the private sector.

This session examines the challenges confronting the CVE ecosystem and discusses the respective roles of the U.S. government and private sector in stabilizing a resilient path forward.

The Administration’s National Cyber Strategy calls for shared responsibility between government and industry, reduced regulatory complexity, and stronger protection of critical infrastructure and supply chains. For corporate security leaders, the key question is: what does this mean in practice – and what outcomes should organizations like NTSC be advocating for?

Participants will explore how programs like the CISA 2015 information-sharing framework, CIRCIA, Recent U.S. Efforts on AI Policy, and emerging national security regulations fit together—and where they don’t. What information should large companies provide, to whom, and how can reporting be aligned across government to improve national security outcomes while reducing operational burden on the private sector?