CVSS 4.0 Environmental metrics let you adjust a vendor's score for your own assets. There are two parts: Security Requirements, which say how much confidentiality, integrity and availability matter on a system, and Modified Base Metrics, which let you change a base value to reflect your controls. Both describe the system, not the flaw.
The two parts
Security Requirements are Confidentiality Requirement (CR), Integrity Requirement (IR) and Availability Requirement (AR). They record how critical the vulnerable device is to you. The values are Low, Medium and High, with Not Defined as the default, which the specification treats as High.
Modified Base Metrics mirror the Base metrics with a "Modified" prefix, such as Modified Attack Vector or Modified Attack Complexity. Leave one at Not Defined and the base value is used.
The FAQ stresses that all Environmental metrics are attributes of the vulnerable system. They have no relation to the flaw itself. That is why they belong to you and not to the vendor.
Examples from the FAQ
- An isolated network. If some systems have no inbound or outbound connections, a maximum Attack Vector of Adjacent can be applied to every vulnerability found on them.
- A web application behind a web application firewall. Attacks become harder, so an increase in Attack Complexity is appropriate.
- A device that could affect human safety, such as a Bluetooth insulin pump or an application that organizes first responders. Enough integrity or availability impact can justify the Safety value for subsequent system impact.
Compensating controls map to the right place. A filter built into the product points to Modified Attack Complexity. An external firewall filter points to Modified Attack Requirements.
Build it once, reuse it everywhere
The FAQ recommends assessing the devices on your network and recording the result in a database such as an asset management system. Document CR, IR and AR per asset, add any modified base values that apply, then reconcile that data with your scan results so every finding picks up its asset's values automatically.
The effort is front loaded. Scoring each finding by hand does not scale. Scoring each asset once does.
What it can and cannot do
Environmental data can lower a score where your controls are real, and it can keep a score high where the asset matters. It does not tell you whether the flaw is being exploited, which is the Threat group's job, and it does not tell you whether your code calls the vulnerable function.
Be careful with optimism. A modified value is a claim about your environment. If the firewall rule changes next quarter, the adjusted score is wrong. Put a review date on any modification, and prefer controls you can verify over controls you believe in.
A starter plan for a small team
- Pick your ten most important systems and set CR, IR and AR for each.
- Mark which are reachable from the internet and which are not.
- Record any control that you are willing to defend in an audit, such as network isolation.
- Apply those values to new findings automatically, and review them every quarter.
For compliance work the same asset register doubles as evidence of how you rank risk. Safeguard's asset discovery helps build that list, and its policies and gates can enforce your thresholds in the pipeline.
Quick check
Do Environmental metrics describe the vulnerability?
No. The FAQ says they are attributes of the vulnerable system and have no relation to the vulnerability itself.
What happens if I leave Security Requirements unset?
They default to Not Defined, which the specification treats as High for the calculation.
Sources
Last reviewed: 19 October 2026.
