A CVSS score rates how bad a flaw is, not how much it matters to you.

When a scanner or a penetration tester reports a flaw, it usually carries a number such as 7.5. That number comes from the Common Vulnerability Scoring System. It asks how the flaw can be reached, how hard it is to use and what an attacker gains, then turns the answers into one score. FIRST, which maintains it, is clear that the score measures severity, not risk.

Spelled out: Common Vulnerability Scoring System, maintained by FIRST (the Forum of Incident Response and Security Teams).

Teams use CVSS to sort findings, set fix deadlines and show auditors that patching follows a rule. That works only if everyone remembers what the base score leaves out: whether the system is exposed, what data it holds, and whether attackers are using the flaw right now. A Critical score on an isolated test server may matter less than a Medium one on your payment API. Version 4.0, released by FIRST in 2023, adds threat and environmental metrics so you can adjust the base score for your own setting, and asks that each score say which metric groups went into it.

Penetration test reports

Each finding usually shows a score and its vector string, the short code listing every metric value behind it.

Vulnerability management policies

Fix timelines are often tied to severity bands, faster for Critical than for Medium.

Public advisories and the National Vulnerability Database

Published vulnerabilities carry base scores from the vendor or the database.

Audit evidence for patching

ISO/IEC 27001 and SOC 2 auditors read the policy's bands and check that fixes met them.

Risk rating

Risk combines likelihood and business impact for your organisation. CVSS rates the flaw; you still decide the risk.

CVE

A CVE is an identifier for a publicly known vulnerability. A CVSS score is often attached to it, but the two are separate systems.

• State which CVSS version your reports and policy use, and do not mix versions in one table.
• Keep the vector string with each score so anyone can check it.
• Adjust for your environment, and record why a finding moved up or down.
• Tie fix timelines to severity bands, with an exception route that someone senior must sign.

• GuideTechnical vulnerability managementFinding, ranking and fixing weaknesses on a schedule.
• GuidePenetration testing for SOC 2What auditors look for in a test report, and what they ignore.
• GuideSecurity testing servicesTesting that reports each finding with its score, vector and a fix you can act on.

Sources: FIRST, Common Vulnerability Scoring System version 4.0 Specification Document and User Guide; FIRST, CVSS version 3.1 Specification Document; NIST National Vulnerability Database documentation on CVSS.