Prioritizing Vulnerability Response: A Stakeholder-Specific Vulnerability Categorization
• SEI Report
Publisher
Software Engineering Institute
Topic or Tag
Abstract
Many organizations use the Common Vulnerability Scoring System (CVSS) to prioritize actions during vulnerability management. This paper—the second part of a research agenda about prioritizing actions during vulnerability management—presents a testable Stakeholder-Specific Vulnerability Categorization (SSVC) that avoids some problems with the CVSS. SSVC takes the form of decision trees for different vulnerability management communities.
An updated version of SSVC is now available: https://resources.sei.cmu.edu/library/asset-view.cfm?assetid=653459.
Cite This SEI Report
Spring, J., Hatleback, E., Householder, A., Manion, A., & Shick, D. (2019, December 4). Prioritizing Vulnerability Response: A Stakeholder-Specific Vulnerability Categorization. Retrieved August 19, 2026, from https://www.sei.cmu.edu/library/prioritizing-vulnerability-response-a-stakeholder-specific-vulnerability-categorization/.
@techreport{spring_2019,
author={Spring, Jonathan and Hatleback, Eric and Householder, Allen and Manion, Art and Shick, Deana},
title={Prioritizing Vulnerability Response: A Stakeholder-Specific Vulnerability Categorization},
month={Dec},
year={2019},
institution={Software Engineering Institute, Carnegie Mellon University},
url={https://www.sei.cmu.edu/library/prioritizing-vulnerability-response-a-stakeholder-specific-vulnerability-categorization/},
note={Accessed: 2026-Aug-19}
}
Spring, Jonathan, Eric Hatleback, Allen Householder, Art Manion, and Deana Shick. "Prioritizing Vulnerability Response: A Stakeholder-Specific Vulnerability Categorization." Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, December 4, 2019. https://www.sei.cmu.edu/library/prioritizing-vulnerability-response-a-stakeholder-specific-vulnerability-categorization/.
J. Spring, E. Hatleback, A. Householder, A. Manion, and D. Shick, "Prioritizing Vulnerability Response: A Stakeholder-Specific Vulnerability Categorization," Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, 4-Dec-2019 [Online]. Available: https://www.sei.cmu.edu/library/prioritizing-vulnerability-response-a-stakeholder-specific-vulnerability-categorization/. [Accessed: 19-Aug-2026].
Spring, Jonathan, Eric Hatleback, Allen Householder, Art Manion, and Deana Shick. "Prioritizing Vulnerability Response: A Stakeholder-Specific Vulnerability Categorization." Software Engineering Institute, Carnegie Mellon University, Software Engineering Institute, 4 Dec. 2019. https://www.sei.cmu.edu/library/prioritizing-vulnerability-response-a-stakeholder-specific-vulnerability-categorization/. Accessed 19 Aug. 2026.
Spring, Jonathan; Hatleback, Eric; Householder, Allen; Manion, Art; & Shick, Deana. Prioritizing Vulnerability Response: A Stakeholder-Specific Vulnerability Categorization. Software Engineering Institute. 2019. https://www.sei.cmu.edu/library/prioritizing-vulnerability-response-a-stakeholder-specific-vulnerability-categorization/