Understanding Acceptance Levels
CVMAP has established a set of Acceptance Levels that a CNA can achieve based on the data they provide through the CVE List. Acceptance Levels are assigned for each submission category and each CNA. This means that a CNA who provides submission data for both CVSS v3.1 and CWE could have an Acceptance Level of Reference for the CVSS v3.1 submission and an Acceptance Level of Contributor for the CWE submission. As CNAs provide submission category data and NVD analysts provide analysis results, the CNA provided data is compared against the NVD analyst data. As the CNA and NVD data align, the Acceptance Level of the CNA for that submission category increases.
The goal for all CNAs is to reach the Provider Acceptance Level for the submission categories in which they participate. Unlike Reference and Contributor; Provider level data is considered equal to that of NVD analysis and is immediately placed into the NVD upon reception. Additionally, Provider level data is audited at a much lower frequency. A level of Non-Acceptance is reserved for if a CNA’s content has been deemed unfit for display on the NVD website and inclusion within the NVD data feeds (i.e., content contains classified, offensive, derogatory or purposefully misleading content).
|Acceptance Level||Acceptance Level Icon||Description
|NVD||All NVD analyst provided data is given the NVD icon. This data is considered equal to the data provided at the Provider Acceptance Level.|