SSVC

Stakeholder-Specific Vulnerability Categorization (SSVC) is a vulnerability prioritization methodology that helps analysts decide on vulnerability response actions consistent with priorities set by their organization. The SSVC methodology was created by CISA and others to prioritize software vulnerabilities based on real-world context and operational impact rather than static severity scores. SSVC analysis takes into account a vulnerability’s exploitation status, impacts to safety, and prevalence of the affected component in the system. Implementing SSVC allows organizations to better prioritize their vulnerability response by building their own customized SSVC decision tree.

SSVC vs. EPSS

A vulnerability may show a high EPSS score while its SSVC exploitation status shows none. This may seem confusing at first, but is easily explained.

EPSS is an exploit prediction measure that estimates the probability that a vulnerability will be exploited in the wild over the next 30 days.
SSVC’s exploitation status reflects whether there is verified evidence that exploitation is already happening in the wild.

EPSS calculates a probability score based on signals like exploit code availability and observed attacker interest and chatter on the net. SSVC is based on confirmed reports or a functional public proof-of-concept of an exploit. In short, a vulnerability can look highly likely to be exploited without yet meeting that evidentiary bar. A high EPSS score is a reasonable signal to prioritize the vulnerability proactively even when SSVC exploitation status is none, since exploitation may simply not have been confirmed yet.

SSVC categories

The following SSVC categories are tracked by Minimus:

Category	Description
Exploitation	Whether exploitation has been confirmed: `None`, `PoC` (public proof-of-concept exists), or `Active` (exploitation observed in the wild)
Automatable	Whether an attacker can automate exploitation at scale (`Yes` / `No`)
Technical Impact	The degree of control an attacker gains by exploiting the vulnerability: `Partial` or `Total`
Source	`CISA Coordinator` means the assessment was published by CISA acting as the coordinating authority for this vulnerability
Updated	The date the SSVC classification was last reviewed or revised

The following two categories are not universal and cannot be tracked by Minimus. They are specific to the organization and can only be tracked at the organizational level:

Category	Description
Mission Prevalence	How essential the vulnerable component is to an entity’s mission-critical functions, ranging from `Minimal` (not mission-essential) to `Support` (supports mission-essential functions) to `Essential` (its failure could cause overall mission failure)
Public Well-being Impact	Severity of physical, environmental, financial, or psychological harm a successful exploit could cause, ranging from `Minimal` (below the threshold for harm) to `Material` (e.g. injuries, major financial loss) to `Irreversible` (e.g. fatalities, collapse of critical systems)

SSVC calculator

CISA offers an SSVC calculator to help with SSVC adoption. The calculator takes into account all categories, including Mission Prevalence and Public Well-being Impact which are specific to the organization and not reflected in Minimus advisories. The calculator provides a tree visualization that can be exported as PDF or JSON with a recommendation as per the selected role:

Coordinator
Developer
Patch applier
Other

CISA SSVC decisions

Working through the CISA SSVC decision tree ultimately resolves to one of 4 decisions: Track, Track*, Attend, or Act (reference).

Decision	Description
Track	The vulnerability does not require action at this time. The organization would continue to track the vulnerability and reassess it if new information becomes available. CISA recommends remediating Track vulnerabilities within standard update timelines.
Track*	The vulnerability contains specific characteristics that may require closer monitoring for changes. CISA recommends remediating Track* vulnerabilities within standard update timelines.
Attend	The vulnerability requires attention from the organization’s internal, supervisory-level individuals. Necessary actions may include requesting assistance or information about the vulnerability and may involve publishing a notification, either internally and/or externally, about the vulnerability. CISA recommends remediating Attend vulnerabilities sooner than standard update timelines.
Act	The vulnerability requires attention from the organizaion’s internal, supervisory-level and leadership-level individuals. Necessary actions include requesting assistance or information about the vulnerability, as well as publishing a notification either internally and/or externally. Typically, internal groups would meet to determine the overall response and then execute agreed upon actions. CISA recommends remediating Act vulnerabilities as soon as possible.

Remediate

Policies

Risk Assessment

Advisories

Scanning

SSVC vs. EPSS

SSVC categories

SSVC calculator

CISA SSVC decisions

​SSVC vs. EPSS

​SSVC categories

​SSVC calculator

​CISA SSVC decisions

SSVC vs. EPSS

SSVC categories

SSVC calculator

CISA SSVC decisions