Glossary

SSVC

Stakeholder-Specific Vulnerability Categorization

A decision-tree method from Carnegie Mellon’s SEI that turns facts such as exploitation status, automatability, technical impact and mission impact into an action; CISA’s version outputs Track, Track*, Attend or Act.

Defined in: CISA: Stakeholder-Specific Vulnerability Categorization

Covered in

Guide

Prioritize vulnerabilities by exploitation, exposure and impact

Rank vulnerabilities with CISA KEV, EPSS, CVSS 4.0 vectors and SSVC decision points, adjust for presence, reachability and asset value, and turn the result into due dates. Covers NVD's 2026 enrichment changes and CISA BOD 26-04.