On June 5, 2024, I sent a FOIA request to National Institute of Standards and Technology requesting a copy of the contract between the National Vulnerability Database (NVD) and ANALYGENCE, a contractor that had been retained to help with the NVD backlog. This was one of two trying to determine how much the U.S. Government was paying that company, via two different agencies and contracts, to perform the same work potentially. The second, a request for CISA’s contract, has not been completed as of now.
A few days ago, on the 19th, NIST completed the request and sent an 84 page PDF with the contract, slightly redacted. I find it interesting that they leave in the “Obligated Amount” for the contract, which is $854,657.00, while redacting three pages of line items. That is for the seven month base period or $122,093.86 per month.
The redaction was performed due to FOIA exemption 5 U.S.C. § 552 Exemption (b)(4) of the FOIA (5 U.S.C. Section 552(b)(4)) which exempts “trade secrets and commercial or financial information obtained from a person and privileged or confidential.” I personally find it odd that we get to know the total contract price, but not the line item breakdown which does not seem like it should be privileged.
You can access the PDF for this at Muckrock. As always, thanks to the Muckrock staff for making FOIA requests considerably easier.