Understanding Acceptance Levels
CVMAP has established a set of Acceptance Levels that a CNA can achieve based on the data they provide through the CVE List. Acceptance Levels are assigned for each submission category and each CNA. This means that a CNA who provides submission data for both CVSS v3.1 and CWE could have an Acceptance Level of Reference for the CVSS v3.1 submission and an Acceptance Level of Contributor for the CWE submission. As CNAs provide submission category data and NVD analysts provide analysis results, the CNA provided data is compared against the NVD analyst data. As the CNA and NVD data align, the Acceptance Level of the CNA for that submission category increases.
The goal for all CNAs is to reach the Provider Acceptance Level for the submission categories in which they participate. Unlike Reference and Contributor; Provider level data is considered to be the same as NVD analyst data and is immediately placed into the NVD data feeds upon reception. Additionally, Provider level data is audited at a much lower frequency. A level of Non-Acceptance is reserved for if a CNA’s content has been deemed unfit for display on the NVD website and inclusion within the NVD data feeds (i.e., content contains classified, offensive, derogatory or purposefully misleading content).
Each Acceptance Level icon has a complimentary checkmark version. These are displayed when the data provided by the CNA matches the data associated by NVD analysts. While Reference and Contributor data is always complemented by NVD analyst data, only a subset of Provider level data will be complemented by NVD analyst data.