zmanion/CVE

CNA (non) performance

Closed this issue · 1 comments

Possibly in SPWG, a dicussion came up about CNAs that do not assign and publish much, or even at all. Should some action be taken for such CNAs?

The proposed CNA Rules reqire that CNAs are responsive to probes but there is no assignment or publication rate requirement.

CNAs who do not assign or publish (much) are essentially no cost to the Program, unless a non-responsive action is needed.

Closing, no changes to current rules revision.