Standards Lab 05 — SSVC Decision Engine + CVSS v4 Vector Parser

Frameworks: SSVC (CISA/CMU SEI), CVSS v4.0 (FIRST). Kind: scoring / process. Extends: Lab 01.

The idea

CVSS gives severity; SSVC (Stakeholder-Specific Vulnerability Categorization) gives a decision by walking a tree over Exploitation / Automatable / Technical Impact / Mission & Well-being to Track / Track* / Attend / Act — the defensible replacement for "patch everything above CVSS 7." This lab implements that decision tree and parses/validates a CVSS v4.0 vector (its new metric groups — Attack Requirements, vulnerable vs subsequent system impacts).

What you build (lab.py)

  • ssvc_decision(exploitation, automatable, technical_impact, mission_wellbeing) → outcome; input validation; a monotone tree (raising any axis never lowers urgency).
  • outcome_rank(outcome) → 0..3 urgency.
  • parse_cvss4_vector(vector) → validated {metric: value} for the 11 v4 base metrics.
  • severity_band(score) → None/Low/Medium/High/Critical.

Cases the tests cover

  • SSVC anchors (all-minimal → Track, all-maximal → Act); active exploitation escalates; invalid input raises; monotonicity across the entire input space (raising any axis never decreases urgency).
  • CVSS v4 vector parsing: valid vector, wrong prefix, missing metric (SA), invalid value; severity banding.

Run

pip install -r requirements.txt
LAB_MODULE=solution pytest -q
pytest -q

Hardening / extensions

  • Encode the exact published CISA SSVC deployer/coordinator lookup tree (36 leaves) instead of the monotone scoring used here.
  • Implement full CVSS v4.0 MacroVector scoring (the official table-based computation).
  • Add CVSS v4 Threat (Exploit Maturity) and Environmental modifiers, and wire SSVC's Exploitation input from KEV/EPSS (Lab 01).

Interview / resume

"Built an SSVC decision engine (Exploitation/Automatable/Technical-Impact/Mission → Track/Track*/ Attend/Act) with a monotonicity guarantee, plus a CVSS v4.0 vector parser — the modern, context-first replacement for prioritizing by a raw CVSS number."

Limitations: SSVC is encoded as a documented monotone tree (not the exact CISA lookup table); CVSS v4 scoring (MacroVector) is out of scope — the lab parses/validates the vector and bands a score.