Not Defined means you have not chosen a value for that metric. In CVSS v4.0, a Security Requirement of Not Defined has the same effect as High, which is the worst case. That keeps a score from understating risk when you lack information about an asset.
Where it shows up
CVSS v4.0 has Confidentiality, Integrity and Availability Requirement metrics, abbreviated CR, IR and AR. They belong to the Environmental group and take the values High, Medium, Low and Not Defined, shown as H, M, L and X in a vector string.
The specification describes Not Defined as the default and says it indicates insufficient information to choose one of the other values. It adds that this has the same effect as assigning High as the worst case.
Why the default is High
A score that guesses low can hide a real problem. If the system had no choice but to assume something, assuming the worst is the cautious path. You get a number that may be higher than reality, but not one that falsely reassures.
This is also why the specification states that Base metrics are combined with default values that assume the highest severity for Threat and Environmental metrics, producing a score from 0 to 10. A base score is the starting point, not a final judgement. Threat and Environmental metrics can then be amended based on applicable threat intelligence and environmental considerations.
What this means for your first rollout
If you start using environmental metrics and fill in only a few assets, expect two groups of results:
| Group | What the scores mean |
|---|---|
| Assets with chosen requirements | Adjusted for what you know |
| Assets with Not Defined | Treated as High, so scores stay at worst case |
Do not compare the two groups as if they came from the same process. A Low rated sandbox and an unlabelled production service differ in information, not just in risk.
How to move out of Not Defined
- List assets with no data label or criticality label.
- Ask the owner what the worst data on the asset is.
- Map the answer to High, Medium or Low for each of confidentiality, integrity and availability.
- Record the source and the date.
- Leave anything unanswered as Not Defined, on purpose.
Step 5 is deliberate. It is better to keep a visible gap than to fill it with a guess.
A common mistake
Some teams treat Not Defined as meaning Medium and set a spreadsheet default accordingly. That quietly lowers scores below what CVSS itself would calculate. If you want a neutral default for your own process, write it down as a policy choice and label it so it is not confused with the CVSS default.
What it does not tell you
A High requirement does not mean an attack is likely. It only says that loss of that property would be serious for the asset. Likelihood comes from exploit evidence, reachability and exposure. Use the requirement for impact, and the other signals for probability.
Quick check
Is Not Defined the same as Medium?
No. In CVSS v4.0 it has the same effect as High.
Should I fill every requirement for every asset?
Start with your most important assets. Leave the rest as Not Defined until someone can answer.
Sources
Last reviewed: 19 October 2026.
