--- title: "CISA KEV product matches for an MSP asset review" description: "Prepare MSP asset reviews from CISA KEV product candidates, authorized inventories, version evidence, and technician decisions without declaring exposure." canonical: "https://scalewithsearch.com/articles/cisa-kev-product-match-msp-asset-review" --- ## Site navigation - [Scale With Search](https://scalewithsearch.com/) - Services - Services - [AI systems](https://scalewithsearch.com/ai-systems) - [Site build](https://scalewithsearch.com/work#site-build) - [Whole website fix](https://scalewithsearch.com/work#whole-website-fix) - [Content library with SEO](https://scalewithsearch.com/work#content-library) - [Working session](https://scalewithsearch.com/audit) - Start here - [Send your brief](https://scalewithsearch.com/work#send-your-brief) - [Example scope](https://scalewithsearch.com/work#review-the-example-scope) - [Prices and terms](https://scalewithsearch.com/work#prices-and-terms) - Industries - Real estate - [Real estate agents and teams](https://scalewithsearch.com/for/real-estate) - [Platforms, ownership, and IDX](https://scalewithsearch.com/for/real-estate/real-estate-website-platforms-ownership-idx) - [Search, content, and AI](https://scalewithsearch.com/for/real-estate/real-estate-search-content-ai) - [Inquiries, campaigns, and handoffs](https://scalewithsearch.com/for/real-estate/real-estate-website-inquiries-campaigns-handoffs) - [Buyer, seller, and local pages](https://scalewithsearch.com/for/real-estate/real-estate-buyer-seller-local-resources) - [Rules, privacy, and trust](https://scalewithsearch.com/for/real-estate/real-estate-website-rules-privacy-trust) - Browse by business - [Trades and home services](https://scalewithsearch.com/for/#group-trades) - [Health, wellness, and animal care](https://scalewithsearch.com/for/#group-practices) - [Law, finance, and IT](https://scalewithsearch.com/for/#group-professional) - [Marketing and SEO agencies](https://scalewithsearch.com/for/#group-agencies) - [Shops and manufacturers](https://scalewithsearch.com/for/#group-manufacturing) - [Restaurants, shops, studios, and nonprofits](https://scalewithsearch.com/for/#group-local-services) - Chiropractic practices - [Chiropractic and wellness practices](https://scalewithsearch.com/for/chiropractic-and-wellness-practices) - [Chiropractic and physical therapy clinics](https://scalewithsearch.com/for/chiropractic-and-physical-therapy-clinics) - [All industries](https://scalewithsearch.com/for/) - Resources - Free tools - [AI readiness check](https://scalewithsearch.com/check) - [Free tools](https://scalewithsearch.com/tools/) - [Free Starter Kit](https://scalewithsearch.com/kit/business-memory-starter-kit.zip) - Guides - [AI-native library](https://scalewithsearch.com/ai-native) - [Industry intelligence](https://scalewithsearch.com/intelligence) - [Office job guides](https://scalewithsearch.com/guides/) - [Business memory](https://scalewithsearch.com/articles/business-memory-for-ai-agents-guide) - [Agent governance](https://scalewithsearch.com/articles/ai-agent-governance-guide-small-business) - [Migration and ownership](https://scalewithsearch.com/articles/leaving-vendor-ai-memory-guide) - Articles - [All articles](https://scalewithsearch.com/articles/) - [What changed](https://scalewithsearch.com/changes/) - About - Evidence - [Proof](https://scalewithsearch.com/proof) - Scale With Search - [About](https://scalewithsearch.com/about) - [How it works](https://scalewithsearch.com/how-it-works) # CISA KEV product matches: prepare an MSP asset review without declaring exposure A managed service provider (MSP) technician starts with one question: does the cited issue apply to this recorded installation? Start with a customer-authorized asset export. Preserve the product candidate, installed version evidence, and technician decision separately. CISA's Known Exploited Vulnerabilities catalog, or KEV, supplies public vulnerability references. CISA maintains an [official data repository](https://github.com/cisagov/kev-data) containing the catalog files and schema. Those references support research; they do not identify your customer's assets. The [MSP intelligence overview](/intelligence/it-and-managed-service-providers) introduces a private exploited-product review. This guide develops its applicability worksheet. Every procedure below is a proposed working method. The examples use fictional customers, products, and advisory details. ## Separate the four identities before matching Give the review four distinct fields: vulnerability identifier, catalog product label, local asset identity, and installed version. Never compress these into a single affected-device label. The [CISA catalog schema](https://raw.githubusercontent.com/cisagov/kev-data/main/known_exploited_vulnerabilities_schema.json) defines `cveID`, `vendorProject`, and `product` as separate fields. It also distinguishes catalog release metadata from individual vulnerability entries. For the local worksheet, use a tenant identifier together with an asset identifier. Retain the export's original product text beside any normalized label. Add a version field whose value points to dated evidence. Treat a similar product name as a candidate for investigation. Ask the technician to establish the product, edition, component, and applicable release from the vendor advisory. If the advisory cannot be read, keep that step unresolved. An asset name is a local reference in this design. A CVE identifier points to a vulnerability reference. Neither substitutes for evidence of the software installed on that asset. ## Define the authorized inventory before reading it Record which customer approved the export, which systems it covers, and when it was produced. Use the minimum fields needed for this review. Keep credentials and unrelated customer records outside the worksheet. Ask the service lead to confirm whether the export covers the intended estate. Record exclusions such as unmanaged equipment or a missing site. Describe those as coverage limits, without guessing what the omitted systems run. Use a read-only copy for preparation. Keep the original export available to authorized reviewers. If a later export changes an asset's version, preserve both observations with their dates. Do not start network scanning to fill a missing field. Assign the evidence request to a technician through the customer's existing authorization process. The preparation task ends where additional access or production action would begin. Keep authorization evidence with the private review. A public product reference does not supply permission to inspect a tenant. The worksheet should name the approved source before any customer-specific conclusion appears. ## Preserve catalog time and local observation time The schema defines `catalogVersion` and `dateReleased` for the catalog. Within each entry, it defines `dateAdded`, `requiredAction`, and `dueDate`. These fields have different roles. [CISA field definitions](https://raw.githubusercontent.com/cisagov/kev-data/main/known_exploited_vulnerabilities_schema.json). Copy the source fields into separately labeled cells. Add your own retrieval timestamp and inventory observation timestamp. Keep source time zones and original values available beside any display formatting. Retain the required-action text with its source reference. If a new release changes that text, preserve the earlier wording that supported a prior review. Ask the responsible technician to read the current instruction before deciding the next step. Do not convert a catalog date into a universal customer deadline. Give the service lead a separate field for applicable obligations and their controlling source. Mark that field unresolved until the lead checks the customer's requirements. This guide does not interpret a directive's applicability to any customer. It also sets no patch deadline. Keep agency fields, customer obligations, and internal review targets under their own labels. ## Work through two fictional customers Consider a synthetic catalog candidate called Example Gateway. Its fictional advisory describes an affected release branch. These names and version details are invented solely to demonstrate the worksheet. Two fictional customers both use asset identifier `GW-01` in their own inventories. Customer A's export records Example Gateway, release 4.2. Customer B's export records Example Gateway Manager, with no version. | Synthetic review field | Customer A | Customer B | | --- | --- | --- | | Tenant identifier | TENANT-A | TENANT-B | | Asset identifier | GW-01 | GW-01 | | Original product text | Example Gateway | Example Gateway Manager | | Export version | 4.2 | Unavailable | | Initial disposition | Product candidate | Product-name similarity only | | Next evidence task | Compare release with fictional advisory | Confirm product identity and version | Use the combined tenant and asset reference for each row. Never transfer Customer A's version evidence into Customer B's record because the asset identifiers match. In this synthetic scenario, the technician opens a fictional advisory that includes Gateway release 4.2. The technician also checks a dated, authorized local record identifying that installation. The resulting entry can say: “Applicability confirmed for this recorded product and release.” That statement does not establish internet exposure or compromise. Keep those questions outside the applicability decision unless a separately authorized review supplies evidence. Record exactly what the technician confirmed. Customer B remains unresolved. The technician requests product identity and version evidence through the approved service process. The record does not inherit Customer A's conclusion or receive a safe label. ## Reject the product-name shortcut Extend the synthetic example with a third row from Customer A. Its product label says Example Gateway Console. The fictional advisory lists Gateway appliances and says nothing about the Console product. Reject the proposed automatic affected match. Record the reason: “Different product identity; advisory applicability not established.” Preserve the candidate and the evidence that caused the rejection. Do not replace that result with “secure.” The decision concerns one attempted match to one advisory. Leave any broader security conclusion outside this worksheet. If a technician later finds an official advisory covering Console, create a new applicability review. Link it to the earlier rejected candidate. Retain the reason the team changed its interpretation. Use similarly narrow wording when no catalog candidate appears. Write “No candidate found in the reviewed source and export.” Add the source version and coverage limits. An absent match should never become a certificate of safety. ## Use the vendor advisory as the version checkpoint For each candidate, record the advisory URL, document title, revision or publication date, and relevant section. Ask the technician to compare the exact edition and release with that section. Retain the local evidence reference in the next column. Name its observation date and the asset it describes. A statement such as “version checked” is incomplete without those references. Where the export and another approved record disagree, preserve both values. Assign the disagreement to a named technician. Do not select the value that produces the cleaner queue. If the advisory refers to conditions beyond the version, write down the unresolved conditions. The technician decides what further authorized evidence is needed. Do not infer configuration, enabled features, or exposure from the product label. Avoid placing remediation instructions into the applicability field. Keep the advisory's relevant instruction available as source evidence. Any execution belongs in the customer's established change process, with its own authorization and validation. ## Build a review worksheet another technician can read Use one row per tenant, asset, and vulnerability candidate. Add separate evidence references when a conclusion depends on more than one record. The following worksheet is an editorial template, not a CISA form. | Field | What to retain | Review question | | --- | --- | --- | | Authorization | Approved export scope and owner | May this inventory support this task? | | Tenant and asset | Separate stable identifiers | Are we reviewing the intended installation? | | Catalog source | URL, version, release time, retrieval time | Which catalog supported the candidate? | | Entry reference | CVE, vendor, product, date added | Which vulnerability entry did we compare? | | Source action | Recorded required action and due-date field | Has the technician opened the current instruction? | | Local evidence | Product, edition, version, observation date | What identifies the recorded installation? | | Advisory evidence | URL, revision, applicability section | What supports the version comparison? | | Uncertainty | Missing, conflicting, or excluded evidence | What prevents a narrower conclusion? | | Technician decision | Named reviewer, date, bounded finding | What was confirmed or rejected? | | Next review | Owner, authorized task, internal target | What happens before reconsideration? | Keep the catalog's due-date field visible even while customer applicability remains under review. Give the obligation owner a direct question. Avoid letting an unresolved obligation disappear inside a generic notes cell. Attach the review to the relevant private ticket or controlled record. Share only within the intended tenant's authorized review group. A cross-customer meeting can use synthetic examples instead of copied asset evidence. ## Keep scoring and applicability in different fields If the team adds EPSS, retain it as a dated, CVE-level input. Use the sibling [EPSS probability and percentile guide](/articles/epss-probability-percentile-msp-review) for its separate interpretation worksheet. Do not let a score complete a missing version check. Require the technician's applicability decision before wording a local finding. Preserve “candidate awaiting version evidence” when that is all the review supports. For queue preparation, show the unresolved task beside the source evidence. The service lead can then assign research without implying that a production change has been authorized. Keep reviewer corrections in the working instructions. The [business memory guide](/articles/business-memory-for-ai-agents-guide) describes retaining decisions in records the business controls. For this task, preserve product alias decisions and the evidence behind them. Before reusing an alias, confirm that its earlier scope fits the new candidate. An alias accepted for one edition should not silently cover a different edition or component. Retain the original text for comparison. ## Close the review with a bounded handoff Ask the technician to state the result in one sentence. Follow it with the evidence references, remaining uncertainty, and next authorized task. Give the receiving owner enough context to reproduce the comparison. A completed applicability review can still require another decision. Keep change approval, customer communication, and any incident assessment in their existing processes. Do not close those tasks merely because the worksheet is complete. The [MSP service overview](/for/it-and-managed-service-providers) describes preparation from approved records. A useful build scope names the permitted exports, tenant boundaries, source history, and acceptance checks. Bring a synthetic inventory sample and your review roles to Scale With Search. Define the desired worksheet before granting access to private records. [Send your brief](/work) ## Sources and limits The official CISA repository, JSON catalog, and schema were reopened on October 28, 2026. The catalog read identified release `2026.10.27`. [Official catalog file](https://raw.githubusercontent.com/cisagov/kev-data/main/known_exploited_vulnerabilities.json). The main CISA catalog page returned an access error during research. This article uses the official repository alternative. It makes no finding about a real asset, customer deadline, exposure, or compromise. All product examples and local evidence are fictional. No vendor advisory was used to assess a real installation. For actual work, reopen the relevant advisory and obtain current authorized evidence before the technician decides applicability. Continue the website review: [AI-native IT providers: the first functions to build](/articles/ai-native-managed-service-providers-first-functions); [EPSS probability and percentile: read two different numbers in an MSP review](/articles/epss-probability-percentile-msp-review); [E-Rate allowable contract dates: distinguish the waiting period from the bid deadline](/articles/erate-allowable-contract-date-bid-deadline); [E-Rate Form 470 changes: keep the current RFP in your bid review](/articles/erate-form-470-rfp-amendment-review); [Managed IT pricing pages: explain what sets the quote](/articles/managed-it-pricing-website-page); [MSP AI rules: data, approvals, and spend](/articles/msp-ai-rules-data-approvals-spend); [MSP case studies: publish evidence without client names](/articles/msp-anonymous-case-study-website); [MSP onboarding pages: explain the first steps](/articles/msp-client-onboarding-website-page); [MSP contact form spam: inspect the receiving path](/articles/msp-contact-form-spam-controls); [MSP cybersecurity website claims: show the scope](/articles/msp-cybersecurity-website-claims); [Google Business Profile for an MSP: check eligibility](/articles/msp-google-business-profile-eligibility); [MSP service area pages: separate on-site and remote](/articles/msp-onsite-service-area-website-pages); [MSP status pages: publish approved incident updates](/articles/msp-public-status-page-website); [MSP buyer guides: make the download useful](/articles/msp-website-buyer-guide-download); [MSP inquiry emails missing: trace the delivery steps](/articles/msp-website-inquiry-email-not-arriving); [MSP website design: separate sales from support](/articles/msp-website-sales-and-support-paths); [Discontinued AV equipment: read Q-SYS service terms before recommending replacement](/articles/qsys-discontinued-equipment-service-terms-review); [Q-SYS compatibility tables: review installed hardware before a software change](/articles/qsys-hardware-software-compatibility-table-review). [IT and managed service providers](/for/it-and-managed-service-providers): website and search resources. ## Related: IT and managed service providers - [EPSS probability and percentile: read two different numbers in an MSP review](/articles/epss-probability-percentile-msp-review) - [E-Rate allowable contract dates: distinguish the waiting period from the bid deadline](/articles/erate-allowable-contract-date-bid-deadline) - [E-Rate Form 470 changes: keep the current RFP in your bid review](/articles/erate-form-470-rfp-amendment-review) ---- ```text .|########||. .|########||. .|########||. |##||. .||##|. |##||. .||##|. |##||. .||##|. |#|. .|#|. |#|. .|#|. |#|. .|#|. |#| |#| |#| |#| |#| |#| .#| |#. .#| |#. .#| |#. .#. .#| .#. .#| .#. .#| |#. .#| |#. .#| |#. .#| |# ...... #| |# ...... #| |# ...... #| .# ||#########| #| .# ||#########| #| .# ||#########| #| .#. |######||######|. .#. .#. |######||######|. .#. .#. |######||######|. .#. #. .##|###|##|#|######| .# #. .##|###|##|#|######| .# #. .##|###|##|#|######| .# || |##|#||||||||||||#||#| || || |##|#||||||||||||#||#| || || |##|#||||||||||||#||#| || # |#||||||||||||||||||||#| #. # |#||||||||||||||||||||#| #. # |#||||||||||||||||||||#| #. || |#||||||||||||||||||||||#| || || |#||||||||||||||||||||||#| || || |#||||||||||||||||||||||#| || # .#||||||||||||||||||||||||#| # # .#||||||||||||||||||||||||#| # # .#||||||||||||||||||||||||#| # || ....|||#||||||##|#|||#|#||##||||....|. || || ....|||#||||||##|#|||#|#||##||||....|. || || ....|||#||||||##|#|||#|#||##||||....|. || #. . ....|# ....#||| ||| .#||| ....#. .# #. . ....|# ....#||| ||| .#||| ....#. .# #. . ....|# ....#||| ||| .#||| ....#. .# # . ||||#| .#####|| . .#| .#||| ||||# #. # . ||||#| .#####|| . .#| .#||| ||||# #. # . ||||#| .#####|| . .#| .#||| ||||# #. .| ||||| #. |#|||||. || #. |#||. .||||| || .| ||||| #. |#|||||. || #. |#||. .||||| || .| ||||| #. |#|||||. || #. |#||. .||||| || || |.... #. ....|#. |. ...|. ....|| || || |.... #. ....|#. |. ...|. ....|| || || |.... #. ....|#. |. ...|. ....|| || #. .||||||##||||||##||####|||||||#||||||#| .# #. .||||||##||||||##||####|||||||#||||||#| .# #. .||||||##||||||##||####|||||||#||||||#| .# # .||####|###########################|. # # .||####|###########################|. # # .||####|###########################|. # # .#||||||.#.|| # |. ..# #| #|||||#| # # .#||||||.#.|| # |. ..# #| #|||||#| # # .#||||||.#.|| # |. ..# #| #|||||#| # # .#|||||| .. |# ## |#| ...#|#|||#| # # .#|||||| .. |# ## |#| ...#|#|||#| # # .#|||||| .. |# ## |#| ...#|#|||#| # # .#|||#|# .# .#| #| ##|.#..#|||||#| # # .#|||#|# .# .#| #| ##|.#..#|||||#| # # .#|||#|# .# .#| #| ##|.#..#|||||#| # # .#||||||############|######|||||#| # # .#||||||############|######|||||#| # # .#||||||############|######|||||#| # # |...||#||||||#||||#|#||||||#|||||#||| |.| # # |...||#||||||#||||#|#||||||#|||||#||| |.| # # |...||#||||||#||||#|#||||||#|||||#||| |.| # #. .. ||||# .|||##|. |#| .|| || .|||#. #| # .# #. .. ||||# .|||##|. |#| .|| || .|||#. #| # .# #. .. ||||# .|||##|. |#| .|| || .|||#. #| # .# || | ...|| ...##| | #| .|. |. ##### .. .| || || | ...|| ...##| | #| .|. |. ##### .. .| || || | ...|| ...##| | #| .|. |. ##### .. .| || || ||||| || ||||#| . |. |. |#. ||||| |#| || || || ||||| || ||||#| . |. |. |#. ||||| |#| || || || ||||| || ||||#| . |. |. |#. ||||| |#| || || .# |.....#|....|#.||||.|||##.|#|....||.#||.#. #. .# |.....#|....|#.||||.|||##.|#|....||.#||.#. #. .# |.....#|....|#.||||.|||##.|#|....||.#||.#. #. #.|||||||#############################| ||| .# #.|||||||#############################| ||| .# #.|||||||#############################| ||| .# || ##||#||#||||||#||#||#||#||##. || || ##||#||#||||||#||#||#||#||##. || || ##||#||#||||||#||#||#||#||##. || # .#|||||||||#||#|||||||||||#| # # .#|||||||||#||#|||||||||||#| # # .#|||||||||#||#|||||||||||#| # || |#||||||||||||||||||||||#| || || |#||||||||||||||||||||||#| || || |#||||||||||||||||||||||#| || .# |#||||||||||||||||||||#| #. .# |#||||||||||||||||||||#| #. .# |#||||||||||||||||||||#| #. || |#||||||||||||||||||#| || || |#||||||||||||||||||#| || || |#||||||||||||||||||#| || #. .######|#|#########| .# #. .######|#|#########| .# #. .######|#|#########| .# .#. |#####||||#####| .#. .#. |#####||||#####| .#. .#. |#####||||#####| .#. |# ||########|| #. |# ||########|| #. |# ||########|| #. |# ...... #| |# ...... #| |# ...... #| |#. .#| |#. .#| |#. .#| |#. .#. |#. .#. |#. .#. .#| |#. .#| |#. .#| |#. |#| |#| |#| |#| |#| |#| .|#|. .|#|. .|#|. .|#|. .|#|. .|#|. |##||. .||##| |##||. .||##| |##||. .||##| .||########||. .||########||. .||########||. Scale With Search 2026 [scalewithsearch.com](https://scalewithsearch.com) ```