CVSS Decision Points

For more information

For more information on the CVSS specification, please refer to the CVSS Specifications.

For convenience, we have provide a list of decision points that are based on the CVSS specification. These decision points can be used to model various decisions based on CVSS vector elements.

Decision Points

The following list of CVSS vector elements have been modeled as SSVC decision points for use in vulnerability response and security decision modeling. We have organized them into groups according to where they belong in the CVSS v4.0 specification document.

About CVSS Decision Point Versions

We have modeled our CVSS-based decision points using the SSVC versioning scheme. Therefore, some decision points may have multiple versions as the concepts have been refined over different versions of the CVSS specification. These versions do not correspond the CVSS specification versions (2.0, 3.0, 3.1, 4.0 etc.).

Qualitative Severity

• CVSS Qualitative Severity Rating Scale

Base Metrics

• Attack Vector
• Attack Complexity
• Attack Requirements
• Privileges Required
• User Interaction
• Confidentiality Impact
• Subsequent Confidentiality Impact
• Integrity Impact
• Subsequent Integrity Impact
• Availability Impact
• Subsequent Availability Impact

Threat Metrics

• Exploit Maturity

Environmental Metrics

• Confidentiality Requirement
• Integrity Requirement
• Availability Requirement

Supplemental Metrics

• Safety
• Automatable
• Provider Urgency
• Recovery
• Value Density
• Vulnerability Response Effort

Older Metrics

• Authentication
• Collateral Damage Potential
• Impact Bias
• Remediation Level
• Report Confidence
• Scope
• Target Distribution