urlscan.io logo urlscan.io
SecurityTrails logo

www.cisa.gov Open in urlscan Pro
2600:141b:13:7af::447a  Public Scan

Back to summary
Submitted URL: https://yxdvmkwi.r.us-west-2.awstrack.me/L0/https:%2F%2Fsanernow.com%2Fspcampaigns%2Fl%2FkbshP5cCMdVrpJru8PUlmA%2FRnMMVPFRsIpzJtNu2aRtjg%...
Effective URL: https://www.cisa.gov/stakeholder-specific-vulnerability-categorization-ssvc?utm_campaign=RP&utm_medium=Email&utm_sour...
Submission: On September 12 via manual from IN — Scanned from US

Form analysis 2 forms found in the DOM

<form class="gsc-search-box gsc-search-box-tools" accept-charset="utf-8">
  <table cellspacing="0" cellpadding="0" role="presentation" class="gsc-search-box">
    <tbody>
      <tr>
        <td class="gsc-input">
          <div class="gsc-input-box" id="gsc-iw-id1">
            <table cellspacing="0" cellpadding="0" role="presentation" id="gs_id50" class="gstl_50 gsc-input" style="width: 100%; padding: 0px;">
              <tbody>
                <tr>
                  <td id="gs_tti50" class="gsib_a"><input autocomplete="off" type="text" size="10" class="gsc-input" name="search" title="search" aria-label="search" id="gsc-i-id1" dir="ltr" spellcheck="false"
                      style="width: 100%; padding: 0px; border: none; margin: 0px; height: auto; outline: none;"></td>
                  <td class="gsib_b">
                    <div class="gsst_b" id="gs_st50" dir="ltr"><a class="gsst_a" href="javascript:void(0)" title="Clear search box" role="button" style="display: none;"><span class="gscb_a" id="gs_cb50" aria-hidden="true">×</span></a></div>
                  </td>
                </tr>
              </tbody>
            </table>
          </div>
        </td>
        <td class="gsc-search-button"><button class="gsc-search-button gsc-search-button-v2"><svg width="13" height="13" viewBox="0 0 13 13">
              <title>search</title>
              <path
                d="m4.8495 7.8226c0.82666 0 1.5262-0.29146 2.0985-0.87438 0.57232-0.58292 0.86378-1.2877 0.87438-2.1144 0.010599-0.82666-0.28086-1.5262-0.87438-2.0985-0.59352-0.57232-1.293-0.86378-2.0985-0.87438-0.8055-0.010599-1.5103 0.28086-2.1144 0.87438-0.60414 0.59352-0.8956 1.293-0.87438 2.0985 0.021197 0.8055 0.31266 1.5103 0.87438 2.1144 0.56172 0.60414 1.2665 0.8956 2.1144 0.87438zm4.4695 0.2115 3.681 3.6819-1.259 1.284-3.6817-3.7 0.0019784-0.69479-0.090043-0.098846c-0.87973 0.76087-1.92 1.1413-3.1207 1.1413-1.3553 0-2.5025-0.46363-3.4417-1.3909s-1.4088-2.0686-1.4088-3.4239c0-1.3553 0.4696-2.4966 1.4088-3.4239 0.9392-0.92727 2.0864-1.3969 3.4417-1.4088 1.3553-0.011889 2.4906 0.45771 3.406 1.4088 0.9154 0.95107 1.379 2.0924 1.3909 3.4239 0 1.2126-0.38043 2.2588-1.1413 3.1385l0.098834 0.090049z">
              </path>
            </svg></button></td>
        <td class="gsc-clear-button">
          <div class="gsc-clear-button" title="clear results">&nbsp;</div>
        </td>
      </tr>
    </tbody>
  </table>
</form>

<form class="gsc-search-box gsc-search-box-tools" accept-charset="utf-8">
  <table cellspacing="0" cellpadding="0" role="presentation" class="gsc-search-box">
    <tbody>
      <tr>
        <td class="gsc-input">
          <div class="gsc-input-box" id="gsc-iw-id2">
            <table cellspacing="0" cellpadding="0" role="presentation" id="gs_id51" class="gstl_51 gsc-input" style="width: 100%; padding: 0px;">
              <tbody>
                <tr>
                  <td id="gs_tti51" class="gsib_a"><input autocomplete="off" type="text" size="10" class="gsc-input" name="search" title="search" aria-label="search" id="gsc-i-id2" dir="ltr" spellcheck="false"
                      style="width: 100%; padding: 0px; border: none; margin: 0px; height: auto; outline: none;"></td>
                  <td class="gsib_b">
                    <div class="gsst_b" id="gs_st51" dir="ltr"><a class="gsst_a" href="javascript:void(0)" title="Clear search box" role="button" style="display: none;"><span class="gscb_a" id="gs_cb51" aria-hidden="true">×</span></a></div>
                  </td>
                </tr>
              </tbody>
            </table>
          </div>
        </td>
        <td class="gsc-search-button"><button class="gsc-search-button gsc-search-button-v2"><svg width="13" height="13" viewBox="0 0 13 13">
              <title>search</title>
              <path
                d="m4.8495 7.8226c0.82666 0 1.5262-0.29146 2.0985-0.87438 0.57232-0.58292 0.86378-1.2877 0.87438-2.1144 0.010599-0.82666-0.28086-1.5262-0.87438-2.0985-0.59352-0.57232-1.293-0.86378-2.0985-0.87438-0.8055-0.010599-1.5103 0.28086-2.1144 0.87438-0.60414 0.59352-0.8956 1.293-0.87438 2.0985 0.021197 0.8055 0.31266 1.5103 0.87438 2.1144 0.56172 0.60414 1.2665 0.8956 2.1144 0.87438zm4.4695 0.2115 3.681 3.6819-1.259 1.284-3.6817-3.7 0.0019784-0.69479-0.090043-0.098846c-0.87973 0.76087-1.92 1.1413-3.1207 1.1413-1.3553 0-2.5025-0.46363-3.4417-1.3909s-1.4088-2.0686-1.4088-3.4239c0-1.3553 0.4696-2.4966 1.4088-3.4239 0.9392-0.92727 2.0864-1.3969 3.4417-1.4088 1.3553-0.011889 2.4906 0.45771 3.406 1.4088 0.9154 0.95107 1.379 2.0924 1.3909 3.4239 0 1.2126-0.38043 2.2588-1.1413 3.1385l0.098834 0.090049z">
              </path>
            </svg></button></td>
        <td class="gsc-clear-button">
          <div class="gsc-clear-button" title="clear results">&nbsp;</div>
        </td>
      </tr>
    </tbody>
  </table>
</form>

Text Content

Skip to main content

An official website of the United States government

Here’s how you know

Here’s how you know

Official websites use .gov
A .gov website belongs to an official government organization in the United
States.

Secure .gov websites use HTTPS
A lock (LockA locked padlock) or https:// means you’ve safely connected to the
.gov website. Share sensitive information only on official, secure websites.


Cybersecurity & Infrastructure Security Agency
America's Cyber Defense Agency

Search

×

search
 

Menu
Close
×

search
 

 * Topics
   Topics
   Cybersecurity Best Practices
   Cyber Threats and Advisories
   Critical Infrastructure Security and Resilience
   Election Security
   Emergency Communications
   Industrial Control Systems
   Information and Communications Technology Supply Chain Security
   Partnerships and Collaboration
   Physical Security
   Risk Management
   How can we help?
   GovernmentEducational InstitutionsIndustryState, Local, Tribal, and
   TerritorialIndividuals and FamiliesSmall and Medium BusinessesFind Help
   LocallyFaith-Based Community
 * Spotlight
 * Resources & Tools
   Resources & Tools
   All Resources & Tools
   Services
   Programs
   Resources
   Training
   Groups
 * News & Events
   News & Events
   News
   Events
   Cybersecurity Alerts & Advisories
   Directives
   Request a CISA Speaker
   Congressional Testimony
 * Careers
   Careers
   Benefits & Perks
   HireVue Applicant Reasonable Accommodations Process
   Hiring
   Resume & Application Tips
   Students & Recent Graduates
   Veteran and Military Spouses
   Work @ CISA
 * About
   About
   Culture
   Divisions & Offices
   Regions
   Leadership
   Doing Business with CISA
   Site Links
   Reporting Employee and Contractor Misconduct
   CISA GitHub
   Contact Us

Report a Cyber Issue
America's Cyber Defense Agency
Breadcrumb
 1. Home

Share:




STAKEHOLDER-SPECIFIC VULNERABILITY CATEGORIZATION (SSVC)



Carnegie Mellon University's Software Engineering Institute (SEI), in
collaboration with CISA, created the Stakeholder-Specific Vulnerability
Categorization (SSVC) system in 2019 to provide the cyber community a
vulnerability analysis methodology that accounts for a vulnerability's
exploitation status, impacts to safety, and prevalence of the affected product
in a singular system. CISA worked with SEI in 2020 to develop its own customized
SSVC decision tree to examine vulnerabilities relevant to the United States
government (USG), as well as state, local, tribal, and territorial (SLTT)
governments, and critical infrastructure entities. Implementing SSVC has allowed
CISA to better prioritize its vulnerability response and vulnerability messaging
to the public. 


STAKEHOLDER-SPECIFIC VULNERABILITY CATEGORIZATION (SSVC) ON DEMAND TRAINING

The On Demand Training instructs analysts on triaging vulnerabilities using a
Stakeholder-Specific Vulnerability Categorization (SSVC) through collecting
evidence, with examples of analysts in different stakeholder roles. Furthermore,
the SSVC is a vulnerability prioritization methodology that helps an analyst
decide on vulnerability response actions consistent with priorities agreed with
the analyst’s leadership.




HOW CISA USES SSVC 

CISA uses its own SSVC decision tree model to prioritize relevant
vulnerabilities into four possible decisions: 

 * Track: The vulnerability does not require action at this time. The
   organization would continue to track the vulnerability and reassess it if new
   information becomes available. CISA recommends remediating Track
   vulnerabilities within standard update timelines. 
 * Track*: The vulnerability contains specific characteristics that may require
   closer monitoring for changes. CISA recommends remediating Track*
   vulnerabilities within standard update timelines. 
 * Attend: The vulnerability requires attention from the organization's
   internal, supervisory-level individuals. Necessary actions include requesting
   assistance or information about the vulnerability, and may involve publishing
   a notification either internally and/or externally. CISA recommends
   remediating Attend vulnerabilities sooner than standard update timelines. 
 * Act: The vulnerability requires attention from the organization's internal,
   supervisory-level and leadership-level individuals. Necessary actions include
   requesting assistance or information about the vulnerability, as well as
   publishing a notification either internally and/or externally. Typically,
   internal groups would meet to determine the overall response and then execute
   agreed upon actions. CISA recommends remediating Act vulnerabilities as soon
   as possible. 

The CISA SSVC tree determines the decisions of Track, Track*, Attend,
and Act based on five values:  

 * Exploitation status  
 * Technical impact  
 * Automatable 
 * Mission prevalence 
 * Public well-being impact 

To learn more, see the CISA SSVC Guide (pdf, 948 kb). 


CISA'S SSVC CALCULATOR 

The CISA SSVC Calculator allows users to input decision values and navigate
through the CISA SSVC tree model to the final overall decision for a
vulnerability affecting their organization. The SSVC Calculator allows users to
export the data as .PDF or JSON. 


ADDITIONAL SSVC DECISION TREE MODELS  

Organizations whose mission spaces need to evaluate the effect of
vulnerabilities in at least one external organization may find the CISA SSVC
decision tree model helpful. The CISA SSVC decision tree model closely resembles
the standard SSVC “Coordinator” tree. For organizations whose mission spaces do
not align with CISA’s decision tree, the SEI whitepaper Prioritizing
Vulnerability Response: A Stakeholder-Specific Vulnerability Categorization
(Version 2.0)(link is external) details other decision tree models that may
better align to their mission space.  


CONTACT US 

For CISA SSVC questions, email vulnerability@cisa.dhs.gov(link sends email) and
include "SSVC" in the subject line.  

For general SSVC questions, contact SEI on GitHub(link is external). If unable
to access the above GitHub site, use this contact form(link is
external) instead. 

Return to top
 * Topics
 * Spotlight
 * Resources & Tools
 * News & Events
 * Careers
 * About

Cybersecurity & Infrastructure Security Agency
 * Facebook
 * Twitter
 * LinkedIn
 * YouTube
 * Instagram
 * RSS

CISA Central 888-282-0870 Central@cisa.dhs.gov(link sends email)
DHS Seal
CISA.gov
An official website of the U.S. Department of Homeland Security
 * About CISA
 * Accessibility
 * Budget and Performance
 * DHS.gov
 * FOIA Requests
 * No FEAR Act
 * Office of Inspector General
 * Privacy Policy
 * Subscribe
 * The White House
 * USA.gov
 * Website Feedback