+ {{mainLabel}} +
++ Within the CVE Program, + + CVE ID + + assignment and + + CVE Record + + publishing take place within a hierarchy. The “Council of Roots” + is the group of Top-Level Roots (TL-Roots) and Roots responsible + for operational governance and administration of these + hierarchies. +
++ Each TL-Root and Root grows and oversees a specific hierarchy as + noted on the + + Structure + + page, while + + CVE Numbering Authorities (CNAs) + + within those hierarchies perform operational tasks such as + assigning CVE IDs and publishing CVE Records. +
++ {{responsibilitiesLabel}} +
++ TL-Roots and Roots share certain responsibilities, but there are + key differences between the two roles. +
+Shared Responsibilities
+-
+
- + Operate within a defined scope + +
- + Oversee CVE-related operations within their hierarchy + +
- + Grow their hierarchy by recruiting and onboarding new CNAs + that report directly to them + +
- + Ensure effective CVE ID assignment and CVE Record publishing by + subordinate organizations + +
- + Ensure + + CNA Operational Rules + + and + + CVE Program Policies + + are followed + +
- + Participate in Council of Roots and other CVE coordination + activities + +
Key Differences
+-
+
- + Reports to the + + CVE Board + + +
- + Recruits, onboards, and manages Roots and/or CNAs + +
- + Must designate a + + CNA of Last Resort (CNA-LR) + + +
- + Resolves + + disputes + + within their hierarchy + +
-
+
- + Reports to a TL-Root or another Root + +
- + Recruits, onboards, and manages CNAs + +
- + May designate a CNA-LR + +
- + Addresses disputes and escalates to the TL-Root when needed + +
+ {{rootsLabel}} +
++ Scope of coverage is described next to their organization name. + Some Roots may also operate a CNA, and as only CNAs may assign CVE + IDs and publish CVE Records in the CVE Program, that + organization's CNA may have a separate CNA-specific scope that may + be different from their Root scope. +
+-
+
-
+
+ + CISA Top-Level Root + + - Vulnerabilities that are (1) reported to + or observed by CISA and (2) affect critical infrastructure, + U.S. civilian government, industrial control systems, or + medical devices, and (3) are not covered by another CNA's + scope. +
+-
+
- + + CERT@VDE Root + + - Organizations that are cooperative partners of CERT@VDE. + +
- + + CISA ICS Root + + - Vulnerabilities that are (1) reported to or observed by + CISA, (2) affect industrial control systems or medical + devices, and (3) are not covered by another CNA's scope. + +
+ -
+
+ + MITRE Top-Level Root + + - Vulnerabilities, and Open-Source software product + vulnerabilities, not already covered by a CNA listed on the + CVE website. +
+-
+
- + + ENISA Root + + - European Union (EU) member states/EU authorities, EU + CSIRTs network members, and cooperative partners under + ENISA's mandate as well as other CNAs who choose ENISA as + their Root. + +
- + + Google Root + + - Alphabet organizations. + +
- + + INCIBE Root + + - Spain organizations. + +
- + + JPCERT/CC Root + + - Japan organizations. + +
- + + Red Hat Root + + - The Red Hat Root's scope includes the open source + community. Any open-source organizations that prefer Red + Hat as their Root; organizations are free to choose + another Root if it suits them better. + +
- + + Thales Group Root + + - Products and technologies of subsidiaries of Thales + Group. + +
+
+ View details of these Root hierarchies on the + + Structure + + page. +
++ {{partnerLabel}} +
++ Start the process by visiting the + + Partner + + page for an overview and prerequisites. +
+