CVE - Adding and Removing CVE Board Members

Section Menu

CVE Community CVE-Compatible Product Vendors CVE Sponsor CVE Numbering Authorities Participating CNAs Documentation for CNAs Requesting CVE IDs from CNAs Become a CNA CVE Board Current Members Email Discussion List Archive Meetings Archive Charter Adding and Removing Members Past Members

ALSO SEE

Adding and Removing CVE Board Members

Date: September 13, 2016Document version: 0.5

Introduction
Adding Board Members
Removing Board Members

Introduction

This document formalizes the high-level process that is used for identifying, evaluating, and adding members to, and removing members from, the CVE Board. Background discussion of the development of this process is contained in the summaries for CVE Board meetings that were held in March 2001 and June 2001, available at:

http://cve.mitre.org/community/board/archives/2001-03/msg00014.html

http://cve.mitre.org/community/board/archives/2001-07/msg00000.html

Organizations are limited to two representatives on the Board. Each organization is encouraged to have two representatives, a technical implementer and a subject matter experts (SMEs), on the Board. Technical implementers include content team members, vulnerability analysts, security researchers, and incident responders. SMEs include product managers, product strategists, chief technology officers, and marketing representatives.

Adding Board Members

1. Prospect Identification

MITRE identifies a prospective Board member ("prospect"), typically through one of the following scenarios:

A current Board member recommends the prospect.
The prospect, or the prospect's parent organization, asks to be a member.
MITRE determines a community that is under-represented, and identifies prospects in that community.
A replacement is sought for a departing Board member.

2. MITRE Evaluation

The prospect is evaluated by MITRE through one or more discussions. At least one discussion, an "interview," is held face-to-face or by phone.

The prospect is presented with the detailed list of member roles and tasks.
MITRE and the prospect identify and discuss the prospect's role and expected tasks.
The prospect provides MITRE with biographical information (such as a resume) that demonstrates an ability to perform the tasks.
The prospect, and the prospect's parent organization, approves the level of effort required for the prospect's participation.

Based on these discussions, MITRE determines if the prospect is qualified to be a Board member, and the process moves to the Board Review step.

3. Board Feedback

MITRE announces a qualified prospect to the Board through a private mailing list.
Board members are provided with at least two weeks to provide feedback to MITRE regarding the prospect, and request additional information if desired.
After the review period, MITRE uses Board feedback to help guide whether the prospect should be approved for membership.

4. Membership Approval

If the prospect is approved by MITRE after the Board Feedback step, then MITRE adds the prospect as a full member to the Board.

The new member is announced to the public Board mailing list. The announcement includes the member's biographical information, role, and expected tasks.
The new member is announced on the CVE website and in the CVE Announce e-newsletter.
The new member begins participating actively, in accordance with his/her expected tasks, within two months of their addition to the Board.

Removing Board Members

MITRE, as the moderator of the Board, reserves the right to remove Board members. Members to be considered for removal can be identified through one of the following scenarios:

A current Board member recommends removal.
The prospect, or the prospect's parent organization, asks to be removed.
MITRE recommends removal.

Removal may be based on:

The individual displays lack of participation.
The individual displays lack of collegiality or professional conduct.
The individual no longer works in a vulnerability-related field.

To maintain the limit of two representatives per organization on the CVE Board, if a merger or acquisition results in an organization having more than two individuals on the Board, then the organization must choose which two individuals will remain on the Board.

MITRE, as moderator, will represent the Board and hold directed discussions with the member being considered for removal regarding the issue at hand, manners to resolve, and potential resignation if applicable. If the situation is unable to be resolved in this manner, the individual's removal will be formalized by a private Board vote. If the Board is unable to reach a consensus, MITRE will make the final decision.

Common Vulnerabilities and Exposures