Understanding Acceptance Levels

CVMAP has established a set of Acceptance Levels that a CNA can achieve based on the data they provide through the CVE List. Acceptance Levels are assigned for each submission category and each CNA. This means that a CNA who provides submission data for both CVSS v3.1 and CWE could have an Acceptance Level of Reference for the CVSS v3.1 submission and an Acceptance Level of Contributor for the CWE submission. As CNAs provide submission category data and NVD analysts provide analysis results, the CNA provided data is compared against the NVD analyst data. As the CNA and NVD data align, the Acceptance Level of the CNA for that submission category increases.

The goal for all CNAs is to reach the Provider Acceptance Level for the submission categories in which they participate. Unlike Reference and Contributor; Provider level data is considered equal to that of NVD analysis and is immediately placed into the NVD upon reception. Additionally, Provider level data is audited at a much lower frequency. A level of Non-Acceptance is reserved for if a CNA’s content has been deemed unfit for display on the NVD website and inclusion within the NVD data feeds (i.e., content contains classified, offensive, derogatory or purposefully misleading content).

Acceptance Level	Acceptance Level Icon	Description
Reference		The CNA is a participant in CVMAP. Data provided at the Reference level is displayed on the NVD website.
Contributor		The CNA is an active participant in CVMAP. Data provided at the Contributor level is displayed on the NVD website.  The CNA has provided enough of the relevant data type and the values provided have aligned with NVD CVMAP practices at a rate granting them the next Acceptance Level.
Provider		The CNA is an active participant in CVMAP. Data provided at the Provider level is displayed on the NVD website.  The CNA has provided enough of the relevant data type and the values provided have aligned with NVD CVMAP practices at a rate granting them the highest Acceptance Level. Provider data is considered to be the same as data provided by NVD analysts. Provider data will be immediately placed into the NVD data feeds and API results. NVD analyst will audit provider less frequently with a minimum of one out of every ten submissions reviewed.
NVD		All NVD analyst provided data is given the NVD icon. This data is considered equal to the data provided at the Provider Acceptance Level.