Skip to content

SSVC: Stakeholder-Specific Vulnerability Categorization

Outcomes

SSVC: Stakeholder-Specific Vulnerability Categorization

Home
SSVC
SSVC Overview
SSVC How-To
SSVC How-To
- Overview
- Getting Started with SSVC
  Getting Started with SSVC
  - Intro
  - Prepare
  - Collect
  - Use & Respond
  - Summary
- Stakeholder Decision Models
  Stakeholder Decision Models
  - Supplier Decision Model
  - Deployer Decision Model
  - Coordinator Decision Models
    Coordinator Decision Models
    
    About Coordination
    
    Coordination Triage
    
    Publication Decision
  - CVSS v4 Analyst Models
    CVSS v4 Analyst Models
    
    About CVSS v4
    
    Equivalence Set 1
    
    Equivalence Set 2
    
    Equivalence Set 3
    
    Equivalence Set 4
    
    Equivalence Set 5
    
    Equivalence Set 6
    
    Qualitative Severity
- Customizing SSVC
- Acuity Ramp
Understanding SSVC
Understanding SSVC
- Intro
- State of Practice
- Representing Information
  Representing Information
- Vulnerability Management Decisions
  Vulnerability Management Decisions
- Putting the Pieces Together
- Worked Example
- Evaluation
- Related Systems
- Information Sources
- Limitations
- Future Work
Reference
Reference
- Intro
- Decision Points
  Decision Points
  - Intro
  - Automatable
  - Exploitation
  - Mission Impact
  - Public Value Added
  - Report Credibility
  - Report Public
  - Safety Impact
  - Supplier Cardinality
  - Supplier Contacted
  - Supplier Engagement
  - Supplier Involvement
  - System Exposure
  - Technical Impact
  - Value Density
  - Compound Decision Points
    Compound Decision Points
    
    Intro
    
    Human Impact
    
    Public Safety Impact
    
    Utility
  - CVSS-based decision points
    CVSS-based decision points
    
    CVSS Decision Points
    
    Qualitative Severity
    
    Base Metrics
    Base Metrics
    
    Attack Vector
    
    Attack Complexity
    
    Attack Requirements
    
    Privileges Required
    
    User Interaction
    
    Confidentiality Impact
    
    Subsequent Confidentiality Impact
    
    Integrity Impact
    
    Subsequent Integrity Impact
    
    Availability Impact
    
    Subsequent Availability Impact
    
    Threat Metrics
    Threat Metrics
    
    Exploit Maturity
    
    Environmental Metrics
    Environmental Metrics
    
    Confidentiality Requirement
    
    Integrity Requirement
    
    Availability Requirement
    
    Supplemental Metrics
    Supplemental Metrics
    
    Safety
    
    Automatable
    
    Provider Urgency
    
    Recovery
    
    Value Density
    
    Vulnerability Response Effort
    
    Older Metrics
    Older Metrics
    
    Authentication
    
    Collateral Damage Potential
    
    Impact Bias
    
    Remediation Level
    
    Report Confidence
    
    Scope
    
    Target Distribution
- Code
  Code
  - Intro
  - Namespaces
  - Selections
  - CSV Analyzer
  - Policy Generator
  - Outcomes Outcomes
    Table of contents
    
    base
    
    groups
  - Doctools
- Learning SSVC
  Learning SSVC
  - Tutorials
Calculator
Policy Explorer
About
About

Outcome Values and Outcome Groups

Provides outcome group and outcome value classes for SSVC.