> ## Documentation Index > Fetch the complete documentation index at: https://docs.minimus.io/llms.txt > Use this file to discover all available pages before exploring further. # SSVC > About SSVC classifications in Minimus advisories, allowing users to prioritize vulnerabilities by exploitation status, safety impact, and prevalence Stakeholder-Specific Vulnerability Categorization (SSVC) is a vulnerability prioritization methodology that helps analysts decide on vulnerability response actions consistent with priorities set by their organization. The SSVC methodology was created by CISA and others to prioritize software vulnerabilities based on real-world context and operational impact rather than static severity scores. SSVC analysis takes into account a vulnerability's exploitation status, impacts to safety, and prevalence of the affected component in the system. Implementing SSVC allows organizations to better prioritize their vulnerability response by building their own customized SSVC decision tree. ## SSVC vs. EPSS A vulnerability may show a high EPSS score while its SSVC exploitation status shows none. This may seem confusing at first, but is easily explained. * EPSS is an exploit prediction measure that estimates the **probability** that a vulnerability will be exploited in the wild over the next 30 days. * SSVC's exploitation status reflects whether there is **verified evidence** that exploitation is already happening in the wild. EPSS calculates a probability score based on signals like exploit code availability and observed attacker interest and chatter on the net. SSVC is based on confirmed reports or a functional public proof-of-concept of an exploit. In short, a vulnerability can look highly likely to be exploited without yet meeting that evidentiary bar. A high EPSS score is a reasonable signal to prioritize the vulnerability proactively even when SSVC exploitation status is `none`, since exploitation may simply not have been confirmed yet. ## SSVC categories The following SSVC categories are tracked by Minimus: | Category | Description | | ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------- | | Exploitation | Whether exploitation has been confirmed: `None`, `PoC` (public proof-of-concept exists), or `Active` (exploitation observed in the wild) | | Automatable | Whether an attacker can automate exploitation at scale (`Yes` / `No`) | | Technical Impact | The degree of control an attacker gains by exploiting the vulnerability: `Partial` or `Total` | | Source | `CISA Coordinator` means the assessment was published by CISA acting as the coordinating authority for this vulnerability | | Updated | The date the SSVC classification was last reviewed or revised | The following two categories are not universal and cannot be tracked by Minimus. They are specific to the organization and can only be tracked at the organizational level: | Category | Description | | ------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Mission Prevalence | How essential the vulnerable component is to an entity's mission-critical functions, ranging from `Minimal` (not mission-essential) to `Support` (supports mission-essential functions) to `Essential` (its failure could cause overall mission failure) | | Public Well-being Impact | Severity of physical, environmental, financial, or psychological harm a successful exploit could cause, ranging from `Minimal` (below the threshold for harm) to `Material` (e.g. injuries, major financial loss) to `Irreversible` (e.g. fatalities, collapse of critical systems) | ## SSVC calculator CISA offers an [SSVC calculator](https://www.cisa.gov/ssvc-calculator) to help with SSVC adoption. The calculator takes into account all categories, including `Mission Prevalence` and `Public Well-being Impact` which are specific to the organization and not reflected in Minimus advisories. The calculator provides a tree visualization that can be exported as PDF or JSON with a recommendation as per the selected role: * Coordinator * Developer * Patch applier * Other ## CISA SSVC decisions Working through the CISA SSVC decision tree ultimately resolves to one of 4 decisions: Track, Track\*, Attend, or Act ([reference](https://www.cisa.gov/sites/default/files/publications/cisa-ssvc-guide%20508c.pdf)). | Decision | Description | | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Track | The vulnerability does not require action at this time. The organization would continue to track the vulnerability and reassess it if new information becomes available. CISA recommends remediating Track vulnerabilities within standard update timelines. | | Track\* | The vulnerability contains specific characteristics that may require closer monitoring for changes. CISA recommends remediating Track\* vulnerabilities within standard update timelines. | | Attend | The vulnerability requires attention from the organization's internal, supervisory-level individuals. Necessary actions may include requesting assistance or information about the vulnerability and may involve publishing a notification, either internally and/or externally, about the vulnerability. CISA recommends remediating Attend vulnerabilities sooner than standard update timelines. | | Act | The vulnerability requires attention from the organizaion's internal, supervisory-level and leadership-level individuals. Necessary actions include requesting assistance or information about the vulnerability, as well as publishing a notification either internally and/or externally. Typically, internal groups would meet to determine the overall response and then execute agreed upon actions. CISA recommends remediating Act vulnerabilities as soon as possible. | ## Related topics - [Prioritizing Vulnerabilities](/remediate/prioritize.md) - [Advisory Drill-Down](/remediate/cve-advisory.md)