Glossary
SSVC (Stakeholder-Specific Vulnerability Categorization)
A decision-tree approach to vulnerability prioritization that outputs an action such as Track, Attend or Act instead of a score.
Stakeholder-Specific Vulnerability Categorization (SSVC) was developed by the CERT Coordination Center at Carnegie Mellon University's Software Engineering Institute. Instead of computing a numeric score, it asks a short series of questions with discrete answers — for example whether a vulnerability is being exploited, whether exploitation can be automated, and what the technical impact is — and the path through the tree leads to a decision.
CISA publishes a widely used version whose decision points are Exploitation, Automatable, Technical Impact, and Mission & Well-being, and whose outcomes are Track, Track*, Attend and Act. The "stakeholder-specific" part means organizations are expected to adapt the tree to their own context.
For a VOC, SSVC makes prioritization explainable and auditable: every decision can be traced to specific facts. See SSVC decision trees.