SSVC Calculator: CISA Track, Attend, Act Decision Tree

SSVC, Stakeholder-Specific Vulnerability Categorization, is a decision-tree method for deciding how urgently to respond to a vulnerability. It was created by Carnegie Mellon University SEI and CERT/CC with CISA, and CISA built its own tree from it in 2020. You answer a few questions about exploitation, how automatable the attack is, technical impact, and how much your mission and public well-being depend on the affected component. The tree returns one of four decisions: Track, Track*, Attend or Act.

Per CISA: Track needs no action at this time, only monitoring and reassessment. Track* has specific characteristics that may need closer monitoring. Attend needs attention from internal supervisory-level people, and CISA recommends remediating sooner than standard update timelines. Act needs supervisory and leadership attention and remediation as soon as possible. Track and Track* both stay within standard update timelines.

CVSS rates how severe a flaw is in itself. SSVC decides what your organisation should do about it, so it asks about evidence of exploitation and your own mission and safety exposure. Two organisations can reach different SSVC decisions for the same CVE with the same CVSS score. They answer different questions and are usually used together.

You do, for your own context. Mission prevalence asks whether the vulnerable component is mission-essential or supports mission-essential functions. Public well-being impact asks about harm to people. CISA's guide has no "unknown" option: if you are unsure, pick the most reasonable assumption from past events and write down why.

No, and neither CISA nor this page claims it should. SSVC does not produce a severity score. It produces a response decision. CVSS still describes the technical characteristics of the flaw, and many teams keep a CVSS score on the record next to the SSVC decision.

CISA says Table 1 of BOD 26-04, which sets remediation timelines, is informed by SSVC. CERT/CC publishes it as an SSVC decision table named cisa:DT_BOD2604:1.0.0 with four inputs (publicly exposed, in KEV, automatable, technical impact) and five outcomes from fix on system upgrade to 3 days with forensic triage. The second tab on this page implements it. The directive binds US federal civilian agencies; others can use it as a benchmark.

No. This is an independent implementation of the published decision table. CISA publishes its own calculator and guide. We checked our 36 rows against the table in CISA's SSVC Guide and the CERT/CC file, and a test script in our repository compares every row. Treat the output as decision support and keep your own record.

Use the best evidence you have today and date the answer, because exploitation status changes. A listing in the CISA Known Exploited Vulnerabilities catalog is evidence of exploitation in the wild. A public exploit in Metasploit or ExploitDB points to PoC. No public exploit and no reports means none. Re-run the calculator when the evidence changes.