← docsSecurity

/triaging-vulnerabilities-with-ssvc-framework

Prioritize vulnerability remediation using SSVC decision logic by combining exploitation i.

Prioritize vulnerability remediation using SSVC decision logic by combining exploitation intelligence, technical impact, and mission context into deterministic response classes.

Category

Security

Execution

7 steps, sequential + gated

Goal

Prioritize vulnerability remediation using SSVC decision logic by combining exploitation intelligence, technical impact, and mission context into deterministic response classes.

Scope

Applies to

  • +Prioritize vulnerabilities with SSVC
  • +Triage CVEs into Act/Attend/Track outcomes
  • +Combine KEV/EPSS with operational risk context

Does not cover

  • −Trivial changes outside the workflow domain

Triggers

"Prioritize vulnerabilities with SSVC""Triage CVEs into Act/Attend/Track outcomes""Combine KEV/EPSS with operational risk context""Create SLA-based remediation priorities"

Inputs

  • →Context: environment/system affected
  • →Scope: change boundary
  • →Constraints: policy or hard rules

Invariants

  • 01SSVC outcomes must be reproducible from explicit decision inputs.
  • 02Exploitation evidence quality must be documented for each decision.
  • 03Critical mission systems receive stricter decision posture.
  • 04Every triage outcome maps to an actionable remediation deadline.
  • 05Exceptions or overrides require rationale and owner approval.

Procedure

  1. Step 1Step 1 — **Ingest and normalize findings**
  2. Step 2Step 2 — **Collect exploitation intelligence**
  3. Step 3Step 3 — **Evaluate SSVC decision points**
  4. Step 4Step 4 — **Apply SSVC decision tree**
  5. Step 5Step 5 — **Map outcomes to actions and SLAs**
  6. Step 6Step 6 — **Validate and calibrate**
  7. Step 7Step 7 — **Publish triage report**

Outputs

  • ▸SSVC triage report with per-vulnerability decision outcomes.
  • ▸Prioritized remediation backlog with SLA targets.
  • ▸Evidence ledger for decision-point inputs and confidence.
  • ▸Exception/override register with owner and rationale.

Review Gate

  • [ ]Every vulnerability has a deterministic SSVC outcome.
  • [ ]Outcome-to-SLA mapping is explicit and actionable.
  • [ ]Exploitation and impact inputs are traceable to evidence.
  • [ ]Overrides/exceptions are documented and approved.
  • [ ]Output supports both analyst review and automation ingestion.