| name | vulns-ssvc-frmwrk |
| description | Triage and prioritize vulnerabilities using CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree framework to produce actionable remediation priorities. |
| domain | cybersecurity |
| subdomain | vulnerability-management |
| tags | ["ssvc","vulnerability-triage","cisa","vulnerability-prioritization","decision-tree","cvss","remediation","risk-management"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["ID.RA-01","ID.RA-02","ID.IM-02","ID.RA-06"] |
Triaging Vulnerabilities with SSVC Framework
Overview
The Stakeholder-Specific Vulnerability Categorization (SSVC) framework, developed by Carnegie Mellon University's Software Engineering Institute (SEI) in collaboration with CISA, provides a structured decision-tree methodology for vulnerability prioritization. Unlike CVSS alone, SSVC accounts for exploitation status, technical impact, automatability, mission prevalence, and public well-being impact to produce one of four actionable outcomes: Track, Track*, Attend, or Act.
When to Use
- When managing security operations that require triaging vulnerabilities with ssvc framework
- When improving security program maturity and operational processes
- When establishing standardized procedures for security team workflows
- When integrating threat intelligence or vulnerability data into operations
Prerequisites
- Python 3.9+ with
requests, pandas, and jinja2 libraries
- Access to CISA KEV catalog API and EPSS API from FIRST
- NVD API key (optional, for higher rate limits)
- Vulnerability scan results from tools like OpenVAS, Nessus, or Qualys
SSVC Decision Points
1. Exploitation Status
Assess current exploitation activity:
- None - No evidence of active exploitation
- PoC - Proof-of-concept exists publicly
- Active - Active exploitation observed in the wild (check CISA KEV)
curl -s "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" | \
python3 -c "import sys,json; data=json.load(sys.stdin); cves=[v['cveID'] for v in data['vulnerabilities']]; print('Active' if 'CVE-2024-3400' in cves else 'Check PoC/None')"
2. Technical Impact
Determine scope of compromise if exploited:
- Partial - Limited to a subset of system functionality or data
- Total - Full control of the affected system, complete data access
3. Automatability
Evaluate if exploitation can be automated at scale:
- No - Requires manual, targeted exploitation per victim
