Understanding Acceptance Levels

CVMAP has established a set of Acceptance Levels that a CNA can achieve based on the data they provide through the CVE List. Acceptance Levels are assigned for each submission category and each CNA. This means that a CNA who provides submission data for both CVSS v3.1 and CWE could have an Acceptance Level of Reference for the CVSS v3.1 submission and an Acceptance Level of Contributor for the CWE submission. As CNAs provide submission category data and NVD analysts provide analysis results, the CNA provided data is compared against the NVD analyst data. As the CNA and NVD data align, the Acceptance Level of the CNA for that submission category increases. 

The goal for all CNAs is to reach the Provider Acceptance Level for the submission categories in which they participate. Unlike Reference and Contributor; Provider level data is considered to be the same as NVD analyst data and is immediately placed into the NVD data feeds upon reception. Additionally, Provider level data is audited at a much lower frequency. A level of Non-Acceptance is reserved for if a CNA’s content has been deemed unfit for display on the NVD website and inclusion within the NVD data feeds (i.e., content contains classified, offensive, derogatory or purposefully misleading content).  
 
Acceptance Level Acceptance Level Icon Description
 
 
Reference
Reference Acceptance Level Icon
  • The CNA is a participant in CVMAP.
  • Data provided at the reference level is displayed on the NVD website. 


Contributor

Contributer Acceptance Level Icon
  • The CNA is an active participant in CVMAP.
  • Data provided at the Contributor level is displayed on the NVD website. 
  • The CNA has provided enough of the relevant data type and the values provided have aligned with NVD CVMAP practices at a rate granting them the next Acceptance Level.



Provider


Provider Acceptance Level Icon
  • The CNA is an active participant in CVMAP.
  • Data provided at the reference level is displayed on the NVD website. 
  • The CNA has provided enough of the relevant data type and the values provided have aligned with NVD CVMAP practices at a rate granting them the highest Acceptance Level.
  • Provider data is considered to be the same as data provided by NVD analysts and will be audited periodically and immediately placed into the NVD data feeds and API results.
NVD NVD Icon All NVD analyst provided data is given the NVD icon. This data is considered to be the same as data provided at the Provider Acceptance Level.
 
Each Acceptance Level icon has a complimentary checkmark version. These are displayed when the data provided by the CNA matches the data associated by NVD analysts.  While Reference and Contributor data is always complemented by NVD analyst data, only a subset of Provider level data will be complemented by NVD analyst data.

Reference Acceptance Level Icon

Contributor Acceptance Level Icon

Provider Acceptance Level Icon