thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Advanced

Stakeholder-Specific Vulnerability Categorization (SSVC)

A decision-tree method for prioritizing vulnerabilities based on exploitation, exposure, automatability and impact.

Definition

SSVC, developed by Carnegie Mellon's CERT/CC and adopted by CISA, results in decisions such as Track, Track*, Attend and Act rather than numeric scores. Decision points include exploitation status, technical impact, automatability and mission and well-being impact.

Example

A vulnerability with active exploitation and total technical impact on a mission-critical system resulting in Act.

Exam tip

SSVC outputs actions, not scores.

Related terms