sbomify logo

How do I become a CVE Numbering Authority (CNA)?

What is a CVE Numbering Authority?

A CVE Numbering Authority (CNA) is an organisation the CVE Program authorises to assign CVE IDs and publish CVE records. Each CNA has a scope, typically “vulnerabilities in our own products”, and assigns IDs only within it.

There are hundreds of CNAs: software vendors, open source foundations, CERTs and bug bounty platforms. They sit under Root CNAs (such as MITRE and CISA), which recruit, onboard and oversee them.

Why become a CNA?

For a software vendor, the main benefits are:

  • Speed: you assign the CVE ID yourself when you are ready to disclose, instead of requesting one from another CNA and waiting
  • Control of the record: you write the description, affected versions and references, so the public CVE record matches your security advisory
  • Credibility: being a CNA signals a mature PSIRT process to customers and auditors
  • Fewer surprise CVEs: researchers come to you, the CNA for your products, rather than to a third party who may publish with less context

If you only ship a fix for a vulnerability once or twice a year, requesting IDs from an existing CNA may be enough. If CVEs in your products are routine, becoming a CNA usually pays off.

Requirements to become a CNA

The CVE Program’s requirements are short, but they assume a working disclosure process. You need:

  1. A public vulnerability disclosure policy that tells researchers how to report to you. See What is a vulnerability disclosure program?
  2. A public source for advisories where you publish vulnerability information, such as a security advisories page or a Trust Center
  3. A defined scope: the products or projects for which you will assign CVE IDs
  4. Agreement to the CNA operational rules, including publishing CVE records with the required minimum information and in a timely way

How to become a CNA: step by step

  1. Get the prerequisites in place: a disclosure policy, a security.txt contact, and a public advisory page with at least one published advisory as an example
  2. Contact the CVE Program through the “Become a CNA” process on cve.org. You will be routed to the Root CNA responsible for your organisation type or region
  3. Agree your scope with the Root CNA
  4. Complete onboarding: training on the CNA rules and on publishing records through the CVE Services tooling
  5. Publish your first records and appear on the CNA list on cve.org

Timelines vary, but expect weeks rather than days. There is no fee to become a CNA.

After you become a CNA

Being a CNA is an ongoing commitment. For every vulnerability in scope you will:

  • triage the report and decide whether it warrants a CVE
  • reserve an ID, fix the issue, and publish the CVE record when you disclose
  • publish your own advisory with the vendor-specific details: affected and fixed versions, workarounds, and timeline

How sbomify helps

sbomify does not assign CVE IDs. It covers the public-facing part a CNA needs to have in place:

  • Security advisories with CVE references, CVSS vectors, affected and fixed version ranges and a dated timeline, published on your Trust Center
  • Every public advisory also served as CSAF 2.0, with discovery via provider-metadata.json
  • A security.txt and a generated vulnerability disclosure policy, the two documents the CVE Program asks about first
← All FAQ