Prioritizing Vulnerability Response: A Stakeholder-Specific Vulnerability Categorization
• White Paper
Software Engineering Institute
Many organizations use the Common Vulnerability Scoring System (CVSS) to prioritize actions during vulnerability management. This paper—the second part of a research agenda about prioritizing actions during vulnerability management—presents a testable Stakeholder-Specific Vulnerability Categorization (SSVC) that avoids some problems with the CVSS. SSVC takes the form of decision trees for different vulnerability management communities.
An updated version of SSVC is now available: https://resources.sei.cmu.edu/library/asset-view.cfm?assetid=653459.