Prioritizing Vulnerability Response: A Stakeholder-Specific Vulnerability Categorization (Version 2.0)
• SEI Report
Publisher
Software Engineering Institute
Topic or Tag
Abstract
The Stakeholder-specific Vulnerability Categorization (SSVC) is a system for prioritizing actions during vulnerability management. SSVC aims to avoid one-size-fits-all solutions in favor of a modular decision-making system with clearly defined and tested parts that vulnerability managers can select and use as appropriate to their context.
Version 2 improves on Version 1.1 (https://weis2020.econinfosec.org/wp-content/uploads/sites/8/2020/06/weis20-final6.pdf) with the addition of the coordinator stakeholder perspective, improvements to terminology, integration of feedback on decision point definitions, and tools to support practical use.
Cite This SEI Report
Spring, J., Householder, A., Hatleback, E., Manion, A., Oliver, M., Sarvepalli, V., Tyzenhaus, L., & Yarbrough, C. (2021, April 30). Prioritizing Vulnerability Response: A Stakeholder-Specific Vulnerability Categorization (Version 2.0). Retrieved October 17, 2026, from https://www.sei.cmu.edu/library/prioritizing-vulnerability-response-a-stakeholder-specific-vulnerability-categorization-version-20/.
@techreport{spring_2021,
author={Spring, Jonathan and Householder, Allen and Hatleback, Eric and Manion, Art and Oliver, Madison and Sarvepalli, Vijay and Tyzenhaus, Laurie and Yarbrough, Charles},
title={Prioritizing Vulnerability Response: A Stakeholder-Specific Vulnerability Categorization (Version 2.0)},
month={Apr},
year={2021},
institution={Software Engineering Institute, Carnegie Mellon University},
url={https://www.sei.cmu.edu/library/prioritizing-vulnerability-response-a-stakeholder-specific-vulnerability-categorization-version-20/},
note={Accessed: 2026-Oct-17}
}
Spring, Jonathan, Allen Householder, Eric Hatleback, Art Manion, Madison Oliver, Vijay Sarvepalli, Laurie Tyzenhaus, and Charles Yarbrough. "Prioritizing Vulnerability Response: A Stakeholder-Specific Vulnerability Categorization (Version 2.0)." Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, April 30, 2021. https://www.sei.cmu.edu/library/prioritizing-vulnerability-response-a-stakeholder-specific-vulnerability-categorization-version-20/.
J. Spring, A. Householder, E. Hatleback, A. Manion, M. Oliver, V. Sarvepalli, L. Tyzenhaus, and C. Yarbrough, "Prioritizing Vulnerability Response: A Stakeholder-Specific Vulnerability Categorization (Version 2.0)," Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, 30-Apr-2021 [Online]. Available: https://www.sei.cmu.edu/library/prioritizing-vulnerability-response-a-stakeholder-specific-vulnerability-categorization-version-20/. [Accessed: 17-Oct-2026].
Spring, Jonathan, Allen Householder, Eric Hatleback, Art Manion, Madison Oliver, Vijay Sarvepalli, Laurie Tyzenhaus, and Charles Yarbrough. "Prioritizing Vulnerability Response: A Stakeholder-Specific Vulnerability Categorization (Version 2.0)." Software Engineering Institute, Carnegie Mellon University, Software Engineering Institute, 30 Apr. 2021. https://www.sei.cmu.edu/library/prioritizing-vulnerability-response-a-stakeholder-specific-vulnerability-categorization-version-20/. Accessed 17 Oct. 2026.
Spring, Jonathan; Householder, Allen; Hatleback, Eric; Manion, Art; Oliver, Madison; Sarvepalli, Vijay; Tyzenhaus, Laurie; & Yarbrough, Charles. Prioritizing Vulnerability Response: A Stakeholder-Specific Vulnerability Categorization (Version 2.0). Software Engineering Institute. 2021. https://www.sei.cmu.edu/library/prioritizing-vulnerability-response-a-stakeholder-specific-vulnerability-categorization-version-20/