SSVC is a decision method that sorts a vulnerability into one of four outcomes: Track, Track star, Attend or Act. CISA uses its own version to prioritize its response. Act means urgent attention from leadership and fast remediation, while Track means keep watching and fix within standard update timelines.
Where SSVC comes from
CISA's page explains that Carnegie Mellon University's Software Engineering Institute, working with CISA, created Stakeholder-Specific Vulnerability Categorization in 2019. The goal was an analysis method that accounts for exploitation status, impact to safety and how common the affected product is, in one system. In 2020 CISA worked with SEI to build its own decision tree for vulnerabilities relevant to the US government, state, local, tribal and territorial governments and critical infrastructure.
The four decisions
| Decision | What it means | CISA's remediation guidance |
|---|---|---|
| Track | No action needed now. Keep tracking and reassess if new information appears | Within standard update timelines |
| Track star | Has specific characteristics that may need closer monitoring for changes | Within standard update timelines |
| Attend | Needs attention from supervisory level people. Request assistance or information, and possibly publish a notice internally or externally | Sooner than standard timelines |
| Act | Needs attention from supervisory and leadership level people. Internal groups meet to decide the response, then execute | As soon as possible |
The five inputs
CISA's tree decides among those outcomes using five values: exploitation status, technical impact, automatable, mission prevalence and public well-being impact. You do not need to run CISA's exact tree to learn from it. It shows which questions carry weight.
- Exploitation status: is anyone using this?
- Technical impact: does the attacker gain partial or total control?
- Automatable: can the steps be scripted at scale?
- Mission prevalence and public well-being: how much of what matters to us does this touch?
Adapting it for your operations team
Many teams get value from the shape without the formal tree.
- Write your own four outcome names, even if they match CISA's, and define each in a sentence.
- For each outcome, name who must be told and who decides. Attend and Act both involve escalation, so list the roles.
- Set a target time for each outcome. Keep it realistic and approved by the people who must meet it.
- Pick two or three inputs you can answer quickly, such as exploitation evidence, exposure and technical impact.
- Review outcomes weekly for the first month and tune.
If a vulnerability is on the CISA Known Exploited Vulnerabilities catalog, CISA describes the catalog as the authoritative record of exploitation status, which is one of the inputs. Matching your findings against that catalog answers the first question without a debate.
What SSVC does not do
It does not tell you how to patch, and it does not replace judgement about your own systems. CISA describes it as a prioritization methodology that helps analysts decide on response actions consistent with priorities agreed with their leadership. The agreement with leadership is the point. A decision tree nobody signed off on will not hold up on a bad day.
Our article comparing CVSS, EPSS, KEV and SSVC shows where SSVC sits among the other signals.
Try it yourself
Click through it at your own pace, or open it full screen.
Step through the questions asked of a finding and see how the answers sort it into an urgent or routine bucket.
Safeguard offers reachability analysis and policies that act on exploitation status, which supply some of these inputs automatically. A free scan shows how.
Quick check
Is SSVC a score?
No. It is a decision tree that produces a category: Track, Track star, Attend or Act.
Do I have to use CISA's tree?
No. CISA created its own for its stakeholders. You can adapt the structure to your own needs and agree it with leadership.
Sources
- CISA, Stakeholder-Specific Vulnerability Categorization (SSVC)
- CISA, Known Exploited Vulnerabilities
Last reviewed: 19 October 2026.
