CVE Numbering Authority (CNA) Scopes

“We Speak CVE” podcast host Shannon Sabens chats with Alicia Mink of the MITRE Top-Level Root and Julia Turkevich of the CISA Top-Level Root about CVE Numbering Authority (CNA) scopes.

Within the CVE™ Program, the term “scope” refers to the set of products, projects, services, organizations, constituencies, or cases for which a CNA is authorized to assign CVE IDs and publish CVE Records. A well-written CNA scope sets expectations, helps manage workload, improves coordination across the CVE ecosystem, and gives vulnerability reporters a clearer path to the right authority.

Topics discussed in this episode include how to write a scope, how the type of CNA organization (vendor, researcher, open source, CERT, hosted service, bug bounty provider, and/or consortium organization) influence what’s included in a scope, ensuring the scope aligns to the CNA Operational Rules, avoiding scope overlap, end-of-life (EOL) products, extended-support products, how scopes might evolve over time, and more.