RE: MS-Word versions of draft Editorial Board governance documents [Was: Two draft Editorial Board governance documents for review and comment]

Hi Kent and Carsten,

Thank you for your always-thoughtful comments and recommendations.

We do not mean to imply that the subject documents have suddenly taken on a new, higher level of importance to the CVE Editorial Board. To the contrary, we have developed many unwritten rules over the years – some of which may be buried in pages of Board discussion threads from years ago, others of which were decided internally by MITRE or developed as “common practice” – and we are beginning to document these rules and practices explicitly. In this case, we simply thought we’d start by picking off the processes and documents that would be most straightforward, and where we thought the Board would be most likely to quickly come to agreement. As always, we are actively seeking Board member comments and suggestions on both documents, and we plan to discuss them during the Board meeting at RSA.

I’m not surprised the documents look like efforts for the OVAL Board – we spoke with the OVAL team quite a bit leading up to those efforts. Your comments based on the efforts relating to the OVAL Board are well-founded, as are the cautions. CVE has traditionally been a “one member – one vote” model, regardless of whether the member was an independent or an organization, as we saw during the Syntax ID change voting.

We do not want nor expect the Board to ever be comprised solely of organizational representatives. By its nature and purpose, the CVE Editorial Board should, and always continue to, be representative of the entire community. That alone requires that the Board include independent members. We mention that point (albeit not very explicitly) on the CVE Editorial Board web page, and leave it open in the draft documents. I personally like the way you phrased the Board membership as “…based on the individuals who have contributed to this community and to CVE.”   I can see places in the document where we can make it more explicit that we seek independent members that can contribute and who view CVE Editorial Board membership to hold (again, as you said), “a personal responsibility to the community.”

With respect to the comment in the document encouraging organizations to have “an implementer and a liaison,” we put that in partly to try to encourage more engagement within organizations where the “implementer” (or, to Carsten’s point, technical) member can sometimes be invisible to those in an organization who might or should otherwise understand CVE within their own organizational context.

We agree that Board members should be active and engaged, and we are seeking comments on the drafts to help us formalize CVE’s and the community’s best interests.

Best Regards,

Steve Boyle

Some people have asked us for editable versions of the two Editorial

Board governance document drafts we recently sent out for your

review and comments. Attached please find MS-Word (.docx) versions

of both documents for your review and comments.

 

We appreciate your time and attention reviewing the drafts, and we

want to thank those of you who have already provided your comments.

 

As we requested in the original transmittance email:

- Please review the documents and send us your comments before April 13th.

- If you do not have any comments or suggestions, a quick email to us

   saying so will record the fact that you have read and reviewed the drafts.

 

Best Regards,

The MITRE CVE Team