Using SSVC

Prerequisites

The Using SSVC section assumes that you have

• An interest in using SSVC in a vulnerability management process
• Basic familiarity with SSVC

If you are unfamiliar with SSVC, we suggest you start with the Understanding SSVC section, which provides necessary background detail. For technical reference, see Reference.

Given a specific stakeholder decision and set of useful decision points, we are now in a position to combine them into a comprehensive set of decisions about the priority with which to act. The definition of choices can take a logical form, such as:

• IF
• (Exploitation IS Public PoC) AND
• (System Exposure IS controlled) AND
• (Automatable IS no) AND
• (Human Impact IS medium)
• THEN priority is scheduled.

This example logical statement is captured in line 35 of the deployer .csv file.

There are different formats for capturing these prioritization decisions depending on how and where they are going to be used. In this documentation, we primarily represent a full set of guidance on how one stakeholder will make a decision as a decision tree.

This section presents example trees for various stakeholders, followed by guidance on how to adapt and customize SSVC to fit your organization's needs.

• Bootstrapping SSVC
• Supplier Decision Model
• Deployer Decision Model
• Coordinator Decision Models
• Customizing SSVC
• Acuity Ramp