ToolsForWeb

Saved

Tap ☆ on any tool to keep it here.

AboutFAQContactPrivacyTerms
toolsforweb

SSVC Calculator

Prioritize a vulnerability with the CISA SSVC decision tree — Track, Track*, Attend or Act.

Runs in your browser — nothing is uploaded

Loading tool…

Results are provided as is, for general information. Check anything important before relying on it. See the Terms of Use.

About this tool

Use this SSVC calculator to turn five assessed inputs into a vulnerability-prioritization decision: Track, Track*, Attend or Act. It implements the CISA Coordinator v2.0.3 tree. Choose exploitation status, whether exploitation is automatable, technical impact, mission prevalence and public well-being impact. The last two inputs combine into Mission & Well-being Impact before the tree determines the outcome. SSVC (Stakeholder-Specific Vulnerability Categorization) comes from Carnegie Mellon SEI's CERT/CC; CISA has its own coordinator tree. The examples below show how changing mission context changes a decision even when the exploit facts stay the same. Inputs are your assessment, not facts retrieved about a CVE. Calculation and vector parsing run in your browser.

How it works

Mission Prevalence + Public Well-Being Impact → Mission & Well-being Impact (Low, Medium, High)
Exploitation + Automatable + Technical Impact + combined impact → Track, Track*, Attend or Act

The CISA Coordinator v2.0.3 model combines five assessed inputs using the guide's impact and decision tables. It does not add scores or calculate a patch deadline. These hypothetical examples specify every input and show the exact vector produced by the tool. In the last two cases, only mission prevalence changes; exploitation remains active, automatable remains Yes, technical impact remains Total and public well-being impact remains Minimal. The combined impact rises from Low to High, changing Attend to Act. This demonstrates why mission context matters; it does not classify a real CVE or waive an applicable remediation requirement.

Worked examples
QuestionWorkingAnswer
Track: no exploitation evidence and limited impactExploitation=None; Automatable=No; Technical Impact=Partial; Mission Prevalence=Minimal; Public Well-Being Impact=Minimal. Minimal + Minimal gives Low combined impact; None + No + Partial + Low gives Track.Track; Mission & Well-being Impact: Low. SSVCv2/E:N/A:N/T:P/P:M/B:M/M:L/D:T
Track*: total impact on a mission-essential component, without exploitation evidenceExploitation=None; Automatable=No; Technical Impact=Total; Mission Prevalence=Essential; Public Well-Being Impact=Minimal. Essential + Minimal gives High combined impact; None + No + Total + High gives Track*.Track*; Mission & Well-being Impact: High. SSVCv2/E:N/A:N/T:T/P:E/B:M/M:H/D:R
Attend: active, automatable exploitation with minimal mission impactExploitation=Active; Automatable=Yes; Technical Impact=Total; Mission Prevalence=Minimal; Public Well-Being Impact=Minimal. Minimal + Minimal gives Low combined impact; Active + Yes + Total + Low gives Attend.Attend; Mission & Well-being Impact: Low. SSVCv2/E:A/A:Y/T:T/P:M/B:M/M:L/D:A
Act: the same exploit facts, now on a mission-essential componentExploitation=Active; Automatable=Yes; Technical Impact=Total; Mission Prevalence=Essential; Public Well-Being Impact=Minimal. Essential + Minimal gives High combined impact; Active + Yes + Total + High gives Act.Act; Mission & Well-being Impact: High. SSVCv2/E:A/A:Y/T:T/P:E/B:M/M:H/D:C

When to use it

Assessing vulnerability priority with the CISA Coordinator tree using exploitation evidence and mission context.
Comparing two mission contexts for the same vulnerability before deciding how to respond.
Recording the chosen inputs as an SSVCv2 vector, alongside your supporting evidence and assessment date.
Comparing a CVSS severity rating with an SSVC prioritization decision; they answer different questions.

Questions

What is SSVC?

Stakeholder-Specific Vulnerability Categorization is a decision-tree method for prioritizing vulnerability responses. Stakeholders assess the inputs for their situation. This calculator uses CISA's coordinator tree, whose outcomes are Track, Track*, Attend and Act; other SSVC trees can use different inputs and outcomes.

SSVC vs CVSS: when do I use each?

CVSS describes vulnerability severity with a numeric score. SSVC produces a prioritization decision using exploitation evidence and stakeholder context. Use the CVSS Calculator for the supported severity metrics, then assess the five SSVC inputs separately. This calculator does not convert a CVSS score into an SSVC decision.

What do Track, Track*, Attend and Act mean?

Track uses standard update timelines and is reassessed when new information arrives. Track* uses the same timeline with closer monitoring. Attend calls for supervisory attention and remediation sooner than standard updates. Act calls for supervisory and leadership attention and remediation as soon as possible. These are the qualitative responses in CISA's November 2022 SSVC guide, not fixed calendar deadlines.

What are the SSVC remediation times for Track and the other outcomes?

The implemented tree does not assign a number of days. CISA's guide recommends remediation within standard update timelines for Track and Track*, sooner than standard timelines for Attend, and as soon as possible for Act. Define the actual schedule through your organization's response process and any applicable requirements; do not turn these labels into an invented universal SLA.

Does an SSVC result determine a KEV remediation deadline?

No. This calculator neither looks up KEV membership nor calculates a due date. CISA's Known Exploited Vulnerabilities catalog records required actions and due dates separately. Check the catalog entry and the requirements that apply to your organization; a Track result does not override an applicable deadline. A vector is an assessment record, not proof of compliance.

Which SSVC version does this calculator implement?

CISA Coordinator v2.0.3: the SSVC 2.0 model with CISA Coordinator tree revision 3. That is the tree identified in CISA's Vulnrichment documentation and the linked CERT/CC reference table. The SSVCv2 vector prefix is a compact format marker, not a claim that this calculator implements every SSVC tree or newer model.

How do I read or paste the SSVC vector string?

The tool emits SSVCv2/ followed by E (exploitation: N=none, P=POC, A=active), A (automatable: N=no, Y=yes), T (technical impact: P=partial, T=total), P (mission prevalence: M=minimal, S=support, E=essential), B (public well-being impact: M=minimal, A=material, I=irreversible), M (combined impact: L=low, M=medium, H=high) and D (decision: T=Track, R=Track*, A=Attend, C=Act). Paste a complete vector to load its five inputs. Remove any trailing timestamp first. The calculator recomputes M and D from those inputs rather than trusting pasted outcomes.

Sources

Related tools

CVSS CalculatorScore a vulnerability with CVSS v3.1 or v4.0 base metrics, or decode a vector string.security.txt GeneratorBuild a valid /.well-known/security.txt file (RFC 9116) from a short form.Content-Security-Policy AnalyzerParse a Content-Security-Policy header into its directives and flag weak or missing protections.