At the inception of CVE in 1999, Candidate Naming Authorities (CNAs) were introduced as entities that could assist identifying and naming vulnerabilities. First a 'problem' was identified as a candidate - potential vulnerability - and given the prefix CAN e.g. CAN-1999-0345. This step could be done by a CNA.