/ 
SSVC-1.00
/ SSVC::CISA

NAME

SSVC::CISA - SSVC CISA Coordinator decision

SYNOPSIS

use SSVC::CISA;

$ssvc = SSVC::CISA->new(
  exploitation             => 'active',
  automatable              => 'yes',
  technical_impact         => 'partial',
  mission_prevalence       => 'minimal',
  public_well_being_impact => 'irreversible',
);

# Get the decision
say $ssvc->decision; # act

# Parse SSVC vector string
$ssvc = SSVC::CISA->from_vector_string('SSVCv2/E:A/A:Y/T:P/P:M/B:I/M:H/D:C/2025-01-01T00:00:00');

# Convert the SSVC object in "vector string"
say $ssvc; # SSVCv2/E:A/A:Y/T:P/P:M/B:I/M:H/D:C/2025-01-01T00:00:00

# Get the decision point value
say $ssvc->public_well_being_impact; # irreversible

# Convert SSVC in JSON in according of SSVC JSON Schema
$json = encode_json($ssvc);

DESCRIPTION

The CISA Stakeholder-Specific Vulnerability Categorization (SSVC) is a customized decision tree model that assists in prioritizing vulnerability response for the United States government (USG), state, local, tribal, and territorial (SLTT) governments; and critical infrastructure (CI) entities. This document serves as a guide for evaluating vulnerabilities using the CISA SSVC decision tree. The goal of SSVC is to assist in prioritizing the remediation of a vulnerability based on the impact exploitation would have to the particular organization(s). The four SSVC scoring decisions, described in this guide, outline how CISA messages out patching prioritization. Any individual or organization can use SSVC to enhance their own vulnerability management practices.

https://www.cisa.gov/sites/default/files/publications/cisa-ssvc-guide%20508c.pdf

CISA

OBJECT-ORIENTED INTERFACE

$ssvc = SSVC->new(%params)

Creates a new SSVC instance using the provided pdecision points.

Parameters / Decision Points:

  • exploitation (required)

  • automatable (required)

  • technical_impact (required)

  • mission_prevalence (required)

  • public_well_being_impact (required)

  • mission_well_being_impact (optional), Computed from "mission_prevalence" and "mission_prevalence"

$ssvc->decision

The vulnerability scoring decision.

  • track, The vulnerability does not require action at this time. The organization would continue to track the vulnerability and reassess it if new information becomes available. CISA recommends remediating Track vulnerabilities within standard update timelines.

  • track*, The vulnerability contains specific characteristics that may require closer monitoring for changes. CISA recommends remediating Track* vulnerabilities within standard update timelines.

  • attend, The vulnerability requires attention from the organization's internal, supervisory-level individuals. Necessary actions may include requesting assistance or information about the vulnerability and may involve publishing a notification, either internally and/or externally, about the vulnerability. CISA recommends remediating Attend vulnerabilities sooner than standard update timelines.

  • act, The vulnerability requires attention from the organization's internal, supervisory-level and leadership-level individuals. Necessary actions include requesting assistance or information about the vulnerability, as well as publishing a notification either internally and/or externally. Typically, internal groups would meet to determine the overall response and then execute agreed upon actions. CISA recommends remediating Act vulnerabilities as soon as possible.

$ssvc = SSVC::CISA->from_vector_string($vector_string);

Converts the given SSVCv2 "vector string" to SSVC::CISA. Croaks on error

$ssvc->TO_JSON

Helper method for JSON modules (JSON, JSON::PP, JSON::XS, Mojo::JSON, etc).

Convert the SSVC object in JSON format.

encode_json($ssvc);

DECISION POINTS

$ssvc->exploitation

(State of) Exploitation

Evidence of Active Exploitation of a Vulnerability

This measure determines the present state of exploitation of the vulnerability. It does not predict future exploitation or measure feasibility or ease of adversary development of future exploit code; rather, it acknowledges available information at time of analysis. As the current state of exploitation often changes over time, answers should be time- stamped. Sources that can provide public reporting of active exploitation include the vendor's vulnerability notification, the National Vulnerability Database (NVD) and links therein, bulletins from relevant information sharing and analysis centers (ISACs), and reliable threat reports that list either the CVE-ID or common name of the vulnerability.

  • none, There is no evidence of active exploitation and no public proof of concept (PoC) of how to exploit the vulnerability.

  • Public poc, One of the following is true: (1) Typical public PoC exists in sources such as Metasploit or websites like ExploitDB; or (2) the vulnerability has a well-known method of exploitation. Some examples of condition (2) are open-source web proxies that serve as the PoC code for how to exploit any vulnerability in the vein of improper validation of Transport Layer Security (TLS) certificates, and Wireshark serving as a PoC for packet replay attacks on ethernet or Wi-Fi networks.

  • active, Shared, observable, and reliable evidence that cyber threat actors have used the exploit in the wild; the public reporting is from a credible source.

$ssvc->automatable

Automatable

Automatable represents the ease and speed with which a cyber threat actor can cause exploitation events. Automatable captures the answer to the question, "Can an attacker reliably automate, creating exploitation events for this vulnerability?" Several factors influence whether an actor can rapidly cause many exploitation events. These include attack complexity, the specific code an actor would need to write or configure themselves, and the usual network deployment of the vulnerable system (i.e., the usual exposure of the system).

  • no, Steps 1-4 of the kill chain-reconnaissance, weaponization, delivery, and exploitation-cannot be reliably automated for this vulnerability. 1 Examples for explanations of why each step may not be reliably automatable include: (1) the vulnerable component is not searchable or enumerable on the network, (2) weaponization may require human direction for each target, (3) delivery may require channels that widely deployed network security configurations block, and (4) exploitation may be frustrated by adequate exploit-prevention techniques enabled by default (address space layout randomization [ASLR] is an example of an exploit-prevention tool).

  • yes, Steps 1-4 of the of the kill chain can be reliably automated. If the vulnerability allows unauthenticated remote code execution (RCE) or command injection, the response is likely yes.

$ssvc->technical_impact

Technical Impact

Technical Impact of Exploiting the Vulnerability

Technical impact is similar to the Common Vulnerability Scoring System (CVSS) base score's concept of "severity." When evaluating technical impact, the definition of scope is particularly important. The decision point, "Total," is relative to the affected component where the vulnerability resides. If a vulnerability discloses authentication or authorization credentials to the system, this information disclosure should also be scored as "Total" if those credentials give an adversary total control of the component.

  • partial, One of the following is true: The exploit gives the threat actor limited control over, or information exposure about, the behavior of the software that contains the vulnerability; or the exploit gives the threat actor a low stochastic opportunity for total control. In this context, "low" means that the attacker cannot reasonably make enough attempts to overcome obstacles, either physical or security-based, to achieve total control. A denial-of-service attack is a form of limited control over the behavior of the vulnerable component.

  • total, The exploit gives the adversary total control over the behavior of the software, or it gives total disclosure of all information on the system that contains the vulnerability.

$ssvc->mission_prevalence

Mission Prevalence

Impact on Mission Essential Functions of Relevant Entities

A mission essential function (MEF) is a function "directly related to accomplishing the organization's mission as set forth in its statutory or executive charter." Identifying MEFs is part of business continuity planning or crisis planning. In contrast to non-essential functions, an organization "must perform a [MEF] during a disruption to normal operations." The mission is the reason an organization exists, and MEFs are how that mission is realized. Non- essential functions support the smooth delivery or success of MEFs rather than directly supporting the mission. In the next list, an "entity" is a USG department or agency, an SLTT government, or a critical infrastructure sector organization.

  • minimal, Neither support nor essential apply. The vulnerable component may be used within the entities, but it is not used as a mission-essential component, nor does it provide impactful support to mission-essential functions.

  • support, The vulnerable component only supports MEFs for two or more entities.

  • essential, The vulnerable component directly provides capabilities that constitute at least one MEF for at least one entity; component failure may (but does not necessarily) lead to overall mission failure.

$ssvc->public_well_being_impact

Public Well-Being Impact

Impacts of Affected System Compromise on Humans

Safety violations are those that negatively impact well-being. SVCC embraces the Centers for Disease Control (CDC) expansive definition of well-being, one that comprises physical, social, emotional, and psychological health.4 Each decision option lists examples of the effects that qualify for that value/answer in the various types of well-being violations. These examples are suggestive and not comprehensive or exhaustive. While technical impact captures adversary control of the computer system, public well-being impact captures wider repercussions.

$ssvc->mission_well_being_impact

Mission and Well-Being Impact

+------------+-----------------------------------+
| Mission    |     Public Well-Being Impact      |
| Prevalence | Minimal | Material | Irreversible |
+------------+---------+----------+--------------+
| Minimal    | Low     | Medium   | High         |
| Support    | Medium  | Medium   | High         |
| Essential  | High    | High     | High         |
+------------+---------+----------+--------------+

Decision Tree

+--------------+-------------+-----------+-------------+----------+
| Exploitation | Automatable | Technical | Mission and | Decision |
|              |             | Impact    | Well-Being  |          |
+--------------+-------------+-----------+-------------+----------+
| none         | no          | partial   | low         | Track    |
| none         | no          | partial   | medium      | Track    |
| none         | no          | partial   | high        | Track    |
| none         | no          | total     | low         | Track    |
| none         | no          | total     | medium      | Track    |
| none         | no          | total     | high        | Track*   |
| none         | yes         | partial   | low         | Track    |
| none         | yes         | partial   | medium      | Track    |
| none         | yes         | partial   | high        | Attend   |
| none         | yes         | total     | low         | Track    |
| none         | yes         | total     | medium      | Track    |
| none         | yes         | total     | high        | Attend   |
| poc          | no          | partial   | low         | Track    |
| poc          | no          | partial   | medium      | Track    |
| poc          | no          | partial   | high        | Track*   |
| poc          | no          | total     | low         | Track    |
| poc          | no          | total     | medium      | Track*   |
| poc          | no          | total     | high        | Attend   |
| poc          | yes         | partial   | low         | Track    |
| poc          | yes         | partial   | medium      | Track    |
| poc          | yes         | partial   | high        | Attend   |
| poc          | yes         | total     | low         | Track    |
| poc          | yes         | total     | medium      | Track*   |
| poc          | yes         | total     | high        | Attend   |
| active       | no          | partial   | low         | Track    |
| active       | no          | partial   | medium      | Track    |
| active       | no          | partial   | high        | Attend   |
| active       | no          | total     | low         | Track    |
| active       | no          | total     | medium      | Attend   |
| active       | no          | total     | high        | Act      |
| active       | yes         | partial   | low         | Attend   |
| active       | yes         | partial   | medium      | Attend   |
| active       | yes         | partial   | high        | Act      |
| active       | yes         | total     | low         | Attend   |
| active       | yes         | total     | medium      | Act      |
| active       | yes         | total     | high        | Act      |
+--------------+-------------+-----------+-------------+----------+

SEE ALSO

SSVC, SSVC::Base

[CISA] Stakeholder-Specific Vulnerability Categorization Guide (https://www.cisa.gov/sites/default/files/publications/cisa-ssvc-guide%20508c.pdf)

SUPPORT

Bugs / Feature Requests

Please report any bugs or feature requests through the issue tracker at https://github.com/giterlizzi/perl-SSVC/issues. You will be notified automatically of any progress on your issue.

Source Code

This is open source software. The code repository is available for public review and contribution under the terms of the license.

https://github.com/giterlizzi/perl-SSVC

git clone https://github.com/giterlizzi/perl-SSVC.git

AUTHOR

  • Giuseppe Di Terlizzi <gdt@cpan.org>

LICENSE AND COPYRIGHT

This software is copyright (c) 2025-2026 by Giuseppe Di Terlizzi.

This is free software; you can redistribute it and/or modify it under the same terms as the Perl 5 programming language system itself.