This screencast goes through the process I used to manage a CVE as part of being the CNA for the Zephyr project. Not all of the links will be accessible, but this should give a rough idea of the kind of work involved in being a CNA.

David