Stakeholder-Specific Vulnerability Categorization

SSVC is a decision tree for prioritising vulnerabilities, developed by the CERT/CC at Carnegie Mellon University and carried forward by Cybersecurity and Infrastructure Security Agency (USA) (CISA). Instead of a number it yields a recommended action (Track, Track*, Attend, Act) from questions such as: is the flaw being exploited, is the attack automatable, how large is the technical impact? CISA adds these assessments directly to Common Vulnerabilities and Exposures (CVE) records.