SSVC, or Stakeholder-Specific Vulnerability Categorization, is a decision tree that turns a handful of questions about a vulnerability into one of four actions. CISA's version uses five values and ends in Track, Track star, Attend or Act. It ranks by what you should do, not by a number.
The five values
CISA's SSVC page lists the values its tree uses: exploitation status, technical impact, automatable, mission prevalence and public well-being impact. The page also says the tree determines decisions of Track, Track with an asterisk, Attend and Act. In this post I write the second as Track star.
Here is each in everyday terms. The wording below is a plain language reading, not CISA's definition, so check the SSVC guide for exact meanings before you adopt it.
| Value | Plain question |
|---|---|
| Exploitation status | Is anyone using this against real targets, or is there public proof it works? |
| Technical impact | If it works, how much control does the attacker get? |
| Automatable | Can an attacker run it at scale without hand holding? |
| Mission prevalence | How central is the affected system to what our organization does? |
| Public well-being impact | If this goes wrong, could people be harmed? |
The first three are about the flaw. The last two are about you, which is exactly where asset context comes in.
Why this is useful for asset context
Most scoring systems describe the vulnerability and stop. SSVC makes the stakeholder part of the decision by design. Two organizations can run the same tree and reach different answers, because their missions differ. The same flaw may lead to Act for a service that people depend on and Track for a hobby project.
That matches how asset context works in practice. Exposure, data and criticality feed the last two values, while exploit evidence feeds the first.
Reading the four outcomes
- Track: no action at this time. Keep tracking and reassess if new information appears. CISA recommends fixing within standard update timelines.
- Track star: specific characteristics may need closer monitoring. Also within standard update timelines.
- Attend: needs attention from supervisory level staff, such as asking for help or publishing a notice. CISA recommends fixing sooner than standard timelines.
- Act: needs supervisory and leadership attention, usually a meeting to agree a response. CISA recommends fixing as soon as possible.
How to try it on your own backlog
- Take ten recent findings.
- Answer the five questions for each, with one person from security and one from the owning team.
- Run them through the CISA SSVC Calculator.
- Compare the decisions with your current priority order.
- Note where they disagree and why.
The disagreements teach more than the agreements. They usually show a missing label, such as a system whose mission role nobody wrote down.
Limits
SSVC needs people to answer the stakeholder questions, and answers can drift or vary between reviewers. Keep a short definition for each level in your own words and link to the guide. It also does not tell you how to schedule the work, only how urgent it is.
It pairs well with exploit evidence from a catalog of exploited flaws and with reachability, which tells you whether your code actually calls the vulnerable function.
Try it yourself
Click through it at your own pace, or open it full screen. Notice how exploit evidence and reachability change the decision before any score is applied.
Quick check
Is SSVC a replacement for CVSS?
It answers a different question. CVSS describes severity, while SSVC recommends an action. Many teams use both.
Do I need the full CISA tree?
Not to start. Practising the five questions on ten findings is useful even before you adopt the full model.
Sources
Last reviewed: 19 October 2026.
