CVE Blog

CNA Rules, Version 2.0 Now in Effect

Comment on LinkedIn | Share this post

Version 2.0 of the CVE Numbering Authorities (CNA) Rules took effect on January 1, 2018. The CNA Rules are the policies and processes for managing the CVE Numbering Authorities (CNAs) Program, and were revised with significant input from the CNA community.

CNA Rules, Version 2.0, which was updated from Version 1.1, includes detailed information on the following:

• CNAs Overview – Federated CNA Structure, and Purpose and Goal of the CNA Rules
• Rules for All CNAs – Assignment, Communication, and Administration
• Responsibilities of Root and Primary CNAs – Specific Assignment, Communications, and Administration Rules for Root CNAs and for the Primary CNA
• CNA Candidate Process – Qualifications, and On-Boarding Process
• Appeals Process
• Definitions
• CVE Information Format
• Common Vulnerabilities and Exposures (CVE) Counting Rules – Purpose, Introduction, Definitions, Vulnerability Report, Inclusion Decisions, and Counting Decisions
• Terms of Use
• Process to Correct Counting Issues
• Acronyms
• Quarterly Metrics
• Disclosure and Embargo Policies

For details about the changes from v1.1 to v2.0, please see our “CNA Rules, Version 2.0 to Take Effect on January 1st” blog article, issue tracker, and change logs.

If you have any questions or comments about the new CNA Rules document, please contact us via our CVE Request web form by selecting “Other” from the dropdown menu.

We look forward to hearing from you!