.gitignore
.markdownlint.yml
CONTRIBUTING.md
COPYRIGHT-code.txt
LICENSE
Makefile
README.md
favicon.ico
mkdocs.yml
pyproject.toml
uv.lock
.github/CODEOWNERS
.github/copilot-instructions.md
.github/dependabot.yml
.github/ISSUE_TEMPLATE/bug_report.md
.github/ISSUE_TEMPLATE/feature_request.md
.github/ISSUE_TEMPLATE/question.md
.github/PULL_REQUEST_TEMPLATE/pull_request_template.md
.github/workflows/deploy_site.yml
.github/workflows/docs_build_check.yml
.github/workflows/link_checker.yml
.github/workflows/lint_md_changes.yml
.github/workflows/python-app.yml
.github/workflows/run_doctools.yml
certcc_ssvc.egg-info/PKG-INFO
certcc_ssvc.egg-info/SOURCES.txt
certcc_ssvc.egg-info/dependency_links.txt
certcc_ssvc.egg-info/entry_points.txt
certcc_ssvc.egg-info/requires.txt
certcc_ssvc.egg-info/top_level.txt
data/LICENSE
data/csvs
data/abnf/ssvc_namespace_pattern.abnf
data/csv/cisa/cisa_bod_26_04_1_0_0.csv
data/csv/cisa/cisa_coordinator_2_0_3.csv
data/csv/cvss/cvss_v4_0_qualitative_severity_ratings_4_0_0.csv
data/csv/cvss/cvss_v4_equivalence_set_1_1_0_0.csv
data/csv/cvss/cvss_v4_equivalence_set_2_1_0_0.csv
data/csv/cvss/cvss_v4_equivalence_set_3_1_0_0.csv
data/csv/cvss/cvss_v4_equivalence_set_4_1_0_0.csv
data/csv/cvss/cvss_v4_equivalence_set_5_1_0_0.csv
data/csv/cvss/cvss_v4_equivalence_set_6_1_0_0.csv
data/csv/ssvc/coordinator_publish_decision_table_1_0_0.csv
data/csv/ssvc/coordinator_triage_1_0_0.csv
data/csv/ssvc/deployer_patch_application_priority_1_0_0.csv
data/csv/ssvc/human_impact_1_0_0.csv
data/csv/ssvc/public_safety_impact_1_0_0.csv
data/csv/ssvc/supplier_patch_development_priority_1_0_0.csv
data/csv/ssvc/utility_1_0_0.csv
data/json/ssvc_object_registry.json
data/json/decision_points/basic/boundary_proximity_1_0_0.json
data/json/decision_points/basic/cis_cti_words_of_estimative_probability_1_0_0.json
data/json/decision_points/basic/do_schedule_delegate_delete_1_0_0.json
data/json/decision_points/basic/lowmediumhigh_1_0_0.json
data/json/decision_points/basic/median_split_1_0_0.json
data/json/decision_points/basic/moscow_1_0_0.json
data/json/decision_points/basic/probability_scale_in_2_equal_levels_ascending_1_0_0.json
data/json/decision_points/basic/probability_scale_in_5_equal_levels_ascending_1_0_0.json
data/json/decision_points/basic/probability_scale_in_5_weighted_levels_ascending_1_0_0.json
data/json/decision_points/basic/quartiles_1_0_0.json
data/json/decision_points/basic/quintiles_1_0_0.json
data/json/decision_points/basic/value_complexity_1_0_0.json
data/json/decision_points/basic/yesno_1_0_0.json
data/json/decision_points/cisa/cisa_bod_26_04_remediation_timelines_1_0_0.json
data/json/decision_points/cisa/cisa_levels_1_1_0.json
data/json/decision_points/cisa/in_kev_1_0_0.json
data/json/decision_points/cisa/mission_prevalence_1_0_0.json
data/json/decision_points/cisa/publicly_exposed_1_0_0.json
data/json/decision_points/cvss/access_complexity_1_0_0.json
data/json/decision_points/cvss/access_complexity_2_0_0.json
data/json/decision_points/cvss/access_vector_1_0_0.json
data/json/decision_points/cvss/access_vector_2_0_0.json
data/json/decision_points/cvss/attack_complexity_3_0_0.json
data/json/decision_points/cvss/attack_complexity_3_0_1.json
data/json/decision_points/cvss/attack_requirements_1_0_0.json
data/json/decision_points/cvss/attack_vector_3_0_0.json
data/json/decision_points/cvss/attack_vector_3_0_1.json
data/json/decision_points/cvss/authentication_1_0_0.json
data/json/decision_points/cvss/authentication_2_0_0.json
data/json/decision_points/cvss/automatable_1_0_0.json
data/json/decision_points/cvss/availability_impact_1_0_0.json
data/json/decision_points/cvss/availability_impact_2_0_0.json
data/json/decision_points/cvss/availability_impact_to_the_subsequent_system_1_0_0.json
data/json/decision_points/cvss/availability_impact_to_the_vulnerable_system_3_0_0.json
data/json/decision_points/cvss/availability_requirement_1_0_0.json
data/json/decision_points/cvss/availability_requirement_1_1_0.json
data/json/decision_points/cvss/availability_requirement_1_1_1.json
data/json/decision_points/cvss/availability_requirement_without_not_defined__1_1_1.json
data/json/decision_points/cvss/collateral_damage_potential_1_0_0.json
data/json/decision_points/cvss/collateral_damage_potential_2_0_0.json
data/json/decision_points/cvss/confidentiality_impact_1_0_0.json
data/json/decision_points/cvss/confidentiality_impact_2_0_0.json
data/json/decision_points/cvss/confidentiality_impact_to_the_subsequent_system_1_0_0.json
data/json/decision_points/cvss/confidentiality_impact_to_the_vulnerable_system_3_0_0.json
data/json/decision_points/cvss/confidentiality_requirement_1_0_0.json
data/json/decision_points/cvss/confidentiality_requirement_1_1_0.json
data/json/decision_points/cvss/confidentiality_requirement_1_1_1.json
data/json/decision_points/cvss/confidentiality_requirement_without_not_defined__1_1_1.json
data/json/decision_points/cvss/cvss_qualitative_severity_rating_scale_1_0_0.json
data/json/decision_points/cvss/equivalence_set_1_1_0_0.json
data/json/decision_points/cvss/equivalence_set_2_1_0_0.json
data/json/decision_points/cvss/equivalence_set_3_1_0_0.json
data/json/decision_points/cvss/equivalence_set_4_1_0_0.json
data/json/decision_points/cvss/equivalence_set_5_1_0_0.json
data/json/decision_points/cvss/equivalence_set_6_1_0_0.json
data/json/decision_points/cvss/exploit_code_maturity_1_2_0.json
data/json/decision_points/cvss/exploit_maturity_2_0_0.json
data/json/decision_points/cvss/exploit_maturity_without_not_defined__2_0_0.json
data/json/decision_points/cvss/exploitability_1_0_0.json
data/json/decision_points/cvss/exploitability_1_1_0.json
data/json/decision_points/cvss/impact_bias_1_0_0.json
data/json/decision_points/cvss/integrity_impact_1_0_0.json
data/json/decision_points/cvss/integrity_impact_2_0_0.json
data/json/decision_points/cvss/integrity_impact_to_the_subsequent_system_1_0_0.json
data/json/decision_points/cvss/integrity_impact_to_the_vulnerable_system_3_0_0.json
data/json/decision_points/cvss/integrity_requirement_1_0_0.json
data/json/decision_points/cvss/integrity_requirement_1_1_0.json
data/json/decision_points/cvss/integrity_requirement_1_1_1.json
data/json/decision_points/cvss/integrity_requirement_without_not_defined__1_1_1.json
data/json/decision_points/cvss/modified_attack_complexity_3_0_0.json
data/json/decision_points/cvss/modified_attack_complexity_3_0_1.json
data/json/decision_points/cvss/modified_attack_requirements_1_0_0.json
data/json/decision_points/cvss/modified_attack_vector_3_0_0.json
data/json/decision_points/cvss/modified_attack_vector_3_0_1.json
data/json/decision_points/cvss/modified_availability_impact_2_0_0.json
data/json/decision_points/cvss/modified_availability_impact_to_the_subsequent_system_1_0_0.json
data/json/decision_points/cvss/modified_availability_impact_to_the_subsequent_system_1_0_1.json
data/json/decision_points/cvss/modified_availability_impact_to_the_subsequent_system_without_not_defined__1_0_1.json
data/json/decision_points/cvss/modified_availability_impact_to_the_vulnerable_system_3_0_0.json
data/json/decision_points/cvss/modified_confidentiality_impact_2_0_0.json
data/json/decision_points/cvss/modified_confidentiality_impact_to_the_subsequent_system_1_0_0.json
data/json/decision_points/cvss/modified_confidentiality_impact_to_the_subsequent_system_1_0_1.json
data/json/decision_points/cvss/modified_confidentiality_impact_to_the_vulnerable_system_3_0_0.json
data/json/decision_points/cvss/modified_integrity_impact_2_0_0.json
data/json/decision_points/cvss/modified_integrity_impact_to_the_subsequent_system_1_0_0.json
data/json/decision_points/cvss/modified_integrity_impact_to_the_subsequent_system_1_0_1.json
data/json/decision_points/cvss/modified_integrity_impact_to_the_subsequent_system_without_not_defined__1_0_1.json
data/json/decision_points/cvss/modified_integrity_impact_to_the_vulnerable_system_3_0_0.json
data/json/decision_points/cvss/modified_privileges_required_1_0_0.json
data/json/decision_points/cvss/modified_privileges_required_1_0_1.json
data/json/decision_points/cvss/modified_scope_1_0_0.json
data/json/decision_points/cvss/modified_user_interaction_1_0_0.json
data/json/decision_points/cvss/modified_user_interaction_2_0_0.json
data/json/decision_points/cvss/privileges_required_1_0_0.json
data/json/decision_points/cvss/privileges_required_1_0_1.json
data/json/decision_points/cvss/provider_urgency_1_0_0.json
data/json/decision_points/cvss/recovery_1_0_0.json
data/json/decision_points/cvss/remediation_level_1_0_0.json
data/json/decision_points/cvss/remediation_level_1_1_0.json
data/json/decision_points/cvss/report_confidence_1_0_0.json
data/json/decision_points/cvss/report_confidence_1_1_0.json
data/json/decision_points/cvss/report_confidence_2_0_0.json
data/json/decision_points/cvss/safety_1_0_0.json
data/json/decision_points/cvss/scope_1_0_0.json
data/json/decision_points/cvss/target_distribution_1_0_0.json
data/json/decision_points/cvss/target_distribution_1_1_0.json
data/json/decision_points/cvss/user_interaction_1_0_0.json
data/json/decision_points/cvss/user_interaction_2_0_0.json
data/json/decision_points/cvss/value_density_1_0_0.json
data/json/decision_points/cvss/vulnerability_response_effort_1_0_0.json
data/json/decision_points/nist_800_30/probability_scale_in_5_weighted_levels_ascending_1_0_0.json
data/json/decision_points/ssvc/automatable_2_0_0.json
data/json/decision_points/ssvc/critical_software_1_0_0.json
data/json/decision_points/ssvc/decline_track_coordinate_1_0_0.json
data/json/decision_points/ssvc/decline_track_coordinate_1_0_1.json
data/json/decision_points/ssvc/defer_scheduled_out_of_cycle_immediate_1_0_0.json
data/json/decision_points/ssvc/exploitation_1_0_0.json
data/json/decision_points/ssvc/exploitation_1_1_0.json
data/json/decision_points/ssvc/high_value_asset_1_0_0.json
data/json/decision_points/ssvc/human_impact_2_0_0.json
data/json/decision_points/ssvc/human_impact_2_0_1.json
data/json/decision_points/ssvc/human_impact_2_0_2.json
data/json/decision_points/ssvc/mission_and_well_being_impact_1_0_0.json
data/json/decision_points/ssvc/mission_impact_1_0_0.json
data/json/decision_points/ssvc/mission_impact_2_0_0.json
data/json/decision_points/ssvc/public_safety_impact_2_0_0.json
data/json/decision_points/ssvc/public_safety_impact_2_0_1.json
data/json/decision_points/ssvc/public_value_added_1_0_0.json
data/json/decision_points/ssvc/public_well_being_impact_1_1_0.json
data/json/decision_points/ssvc/publish_do_not_publish_1_0_0.json
data/json/decision_points/ssvc/report_credibility_1_0_0.json
data/json/decision_points/ssvc/report_public_1_0_0.json
data/json/decision_points/ssvc/safety_impact_1_0_0.json
data/json/decision_points/ssvc/safety_impact_2_0_0.json
data/json/decision_points/ssvc/safety_impact_2_0_1.json
data/json/decision_points/ssvc/supplier_cardinality_1_0_0.json
data/json/decision_points/ssvc/supplier_contacted_1_0_0.json
data/json/decision_points/ssvc/supplier_engagement_1_0_0.json
data/json/decision_points/ssvc/supplier_involvement_1_0_0.json
data/json/decision_points/ssvc/system_exposure_1_0_0.json
data/json/decision_points/ssvc/system_exposure_1_0_1.json
data/json/decision_points/ssvc/technical_impact_1_0_0.json
data/json/decision_points/ssvc/utility_1_0_0.json
data/json/decision_points/ssvc/utility_1_0_1.json
data/json/decision_points/ssvc/value_density_1_0_0.json
data/json/decision_points/ssvc/virulence_1_0_0.json
data/json/decision_points/x_com_yahooinc_prioritized_risk_remediation/theparanoids_1_0_0.json
data/json/decision_tables/cisa/cisa_bod_26_04_1_0_0.json
data/json/decision_tables/cisa/cisa_coordinator_2_0_3.json
data/json/decision_tables/cvss/cvss_v4_0_qualitative_severity_ratings_4_0_0.json
data/json/decision_tables/cvss/cvss_v4_equivalence_set_1_1_0_0.json
data/json/decision_tables/cvss/cvss_v4_equivalence_set_2_1_0_0.json
data/json/decision_tables/cvss/cvss_v4_equivalence_set_3_1_0_0.json
data/json/decision_tables/cvss/cvss_v4_equivalence_set_4_1_0_0.json
data/json/decision_tables/cvss/cvss_v4_equivalence_set_5_1_0_0.json
data/json/decision_tables/cvss/cvss_v4_equivalence_set_6_1_0_0.json
data/json/decision_tables/ssvc/coordinator_publish_decision_table_1_0_0.json
data/json/decision_tables/ssvc/coordinator_triage_1_0_0.json
data/json/decision_tables/ssvc/deployer_patch_application_priority_1_0_0.json
data/json/decision_tables/ssvc/human_impact_1_0_0.json
data/json/decision_tables/ssvc/public_safety_impact_1_0_0.json
data/json/decision_tables/ssvc/supplier_patch_development_priority_1_0_0.json
data/json/decision_tables/ssvc/utility_1_0_0.json
data/schema/README.MD
data/schema/SSVC_Computed.schema.json
data/schema/SSVC_Provision.schema.json
data/schema/current/Decision_Point.schema.json
data/schema/current/Decision_Point_Group.schema.json
data/schema/current/Decision_Point_Value_Selection.schema.json
data/schema/current/Decision_Table.schema.json
data/schema/current/Outcome_Group-1-0-1.schema.json
data/schema/v1/Decision_Point-1-0-1.schema.json
data/schema/v1/Decision_Point_Group-1-0-1.schema.json
data/schema/v1/Decision_Point_Group-1-1-0.schema.json
data/schema/v1/Decision_Point_Value_Selection-1-0-1.schema.json
data/schema/v1/Outcome_Group-1-0-1.schema.json
data/schema/v2/DecisionPointGroup_2_0_0.schema.json
data/schema/v2/DecisionPoint_2_0_0.schema.json
data/schema/v2/DecisionTable_2_0_0.schema.json
data/schema/v2/Decision_Point-2-0-0.schema.json
data/schema/v2/Decision_Point_Group-2-0-0.schema.json
data/schema/v2/Decision_Point_Value_Selection-2-0-0.schema.json
data/schema/v2/Decision_Table-2-0-0.schema.json
data/schema/v2/README.md
data/schema/v2/SelectionList_2_0_0.schema.json
data/schema/v2/SsvcObjectRegistry_2_0_0.schema.json
data/schema/v2/Ssvc_Object_Registry-2-0-0.schema.json
data/schema_examples/CVE-1900-1234-Decision_Point_Value_Selection-2-0-0.json
data/schema_examples/CVE-1900-1234-Decision_Point_Value_Selection.json
data/schema_examples/index.md
data/schema_examples/archive/Computed-CVE-2014-0751-Coordinator-with-tree.json
data/schema_examples/archive/Computed-CVE-2014-0751-Coordinator.json
data/schema_examples/archive/index.md
doc/LICENSE
doc/graphics/cvss_tree_score-severity.txt
doc/graphics/ssvc_2_coord-publish.tex
doc/graphics/ssvc_2_coord-triage.tex
doc/graphics/ssvc_2_deployer_SeEUMss.tex
doc/graphics/ssvc_2_supplier.tex
doc/md_src_files/sources_ssvc.bib
docker/.dockerignore
docker/Dockerfile
docker/docker-compose.yml
docker/env_example
docs/LICENSE
docs/data
docs/index.md
docs/_includes/ADR0014.md
docs/_includes/_cvss4_question.md
docs/_includes/_scrollable_table.md
docs/_includes/_tree_notation_tip.md
docs/_includes/automatable_cvss_ssvc.md
docs/_includes/cwe-with-poc-examples.md
docs/_includes/default_automatable_values.md
docs/_includes/default_exploitation_values.md
docs/_includes/default_mission_impact_values.md
docs/_includes/default_safety_values.md
docs/_includes/default_system_exposure_values.md
docs/_includes/helping_out.md
docs/_includes/question_callout.md
docs/_includes/safety_cvss_ssvc.md
docs/_includes/value_density_cvss_ssvc.md
docs/about/acknowledgements.md
docs/about/changelog.md
docs/about/contact_us.md
docs/about/contributing.md
docs/about/copyright.md
docs/about/index.md
docs/adr/0000-record-architecture-decisions.md
docs/adr/0001-use-markdown-architectural-decision-records.md
docs/adr/0002-ssvc-decision-points-are-versioned.md
docs/adr/0003-ssvc-decision-point-versioning-rules.md
docs/adr/0004-ssvc-decision-point-groups-are-versioned.md
docs/adr/0005-ssvc-decision-point-group-versioning.md
docs/adr/0006-ssvc-decision-point-versioning-rules.md
docs/adr/0007-descriptions-exclude-examples.md
docs/adr/0008-decision-points-are-ordered-sets.md
docs/adr/0009-outcomes-are-ordered-sets.md
docs/adr/0010-outcome-sets-are-separate-from-decision-point-groups.md
docs/adr/0011-automatable-and-value-density-and-CVSSv4.md
docs/adr/0012-ssvc-namespaces.md
docs/adr/0013-ssvc-project-versions.md
docs/adr/0014-use-decision-table-terminology.md
docs/adr/0015-ssvc-json-schemas-use-schemaver.md
docs/adr/_template.md
docs/adr/index.md
docs/assets/Software_Engineering_Institute_Unitmark_White.svg
docs/assets/cert.png
docs/assets/cert_seal.svg
docs/howto/acuity_ramp.md
docs/howto/cisa_response.md
docs/howto/coordination_intro.md
docs/howto/coordination_triage_decision.md
docs/howto/deployer_tree.md
docs/howto/index.md
docs/howto/publication_decision.md
docs/howto/supplier_tree.md
docs/howto/tree_customization.md
docs/howto/bootstrap/_steps_table.md
docs/howto/bootstrap/collect.md
docs/howto/bootstrap/index.md
docs/howto/bootstrap/prepare.md
docs/howto/bootstrap/summary.md
docs/howto/bootstrap/use.md
docs/howto/cvss_v4/eq1.md
docs/howto/cvss_v4/eq2.md
docs/howto/cvss_v4/eq3.md
docs/howto/cvss_v4/eq4.md
docs/howto/cvss_v4/eq5.md
docs/howto/cvss_v4/eq6.md
docs/howto/cvss_v4/index.md
docs/howto/cvss_v4/qualitative.md
docs/howto/gathering_info/automatable.md
docs/howto/gathering_info/exploitation.md
docs/howto/gathering_info/index.md
docs/howto/gathering_info/mission_impact.md
docs/howto/gathering_info/system_exposure.md
docs/howto/gathering_info/technical_impact.md
docs/howto/gathering_info/value_density.md
docs/howto/tools/containers.md
docs/howto/using_epss/epss_percentiles.md
docs/howto/using_epss/epss_probability.md
docs/howto/using_epss/index.md
docs/javascripts/mathjax.js
docs/javascripts/tablesort.js
docs/pdf/ssvc_2_coord-publish.pdf
docs/pdf/ssvc_2_coord-triage.pdf
docs/pdf/ssvc_2_deployer_SeEUMss.pdf
docs/pdf/ssvc_2_supplier.pdf
docs/reference/index.md
docs/reference/code/analyze_csv.md
docs/reference/code/decision_point_groups.md
docs/reference/code/decision_points.md
docs/reference/code/decision_tables.md
docs/reference/code/doctools.md
docs/reference/code/index.md
docs/reference/code/namespaces.md
docs/reference/code/policy_generator.md
docs/reference/code/selection.md
docs/reference/decision_points/automatable.md
docs/reference/decision_points/compound_decision_points.md
docs/reference/decision_points/exploitation.md
docs/reference/decision_points/human_impact.md
docs/reference/decision_points/index.md
docs/reference/decision_points/mission_impact.md
docs/reference/decision_points/outcomes.md
docs/reference/decision_points/public_safety_impact.md
docs/reference/decision_points/public_value_added.md
docs/reference/decision_points/report_credibility.md
docs/reference/decision_points/report_public.md
docs/reference/decision_points/safety_impact.md
docs/reference/decision_points/supplier_cardinality.md
docs/reference/decision_points/supplier_contacted.md
docs/reference/decision_points/supplier_engagement.md
docs/reference/decision_points/supplier_involvement.md
docs/reference/decision_points/system_exposure.md
docs/reference/decision_points/technical_impact.md
docs/reference/decision_points/utility.md
docs/reference/decision_points/value_density.md
docs/reference/decision_points/cisa/in_kev.md
docs/reference/decision_points/cisa/index.md
docs/reference/decision_points/cisa/mission_prevalence.md
docs/reference/decision_points/cisa/publicly_exposed.md
docs/reference/decision_points/cvss/attack_complexity.md
docs/reference/decision_points/cvss/attack_requirements.md
docs/reference/decision_points/cvss/attack_vector.md
docs/reference/decision_points/cvss/authentication.md
docs/reference/decision_points/cvss/automatable.md
docs/reference/decision_points/cvss/availability_impact.md
docs/reference/decision_points/cvss/availability_requirement.md
docs/reference/decision_points/cvss/collateral_damage_potential.md
docs/reference/decision_points/cvss/confidentiality_impact.md
docs/reference/decision_points/cvss/confidentiality_requirement.md
docs/reference/decision_points/cvss/exploit_maturity.md
docs/reference/decision_points/cvss/impact_bias.md
docs/reference/decision_points/cvss/index.md
docs/reference/decision_points/cvss/integrity_impact.md
docs/reference/decision_points/cvss/integrity_requirement.md
docs/reference/decision_points/cvss/privileges_required.md
docs/reference/decision_points/cvss/provider_urgency.md
docs/reference/decision_points/cvss/qualitative_severity.md
docs/reference/decision_points/cvss/recovery.md
docs/reference/decision_points/cvss/remediation_level.md
docs/reference/decision_points/cvss/report_confidence.md
docs/reference/decision_points/cvss/safety.md
docs/reference/decision_points/cvss/scope.md
docs/reference/decision_points/cvss/subsequent_availability_impact.md
docs/reference/decision_points/cvss/subsequent_confidentiality_impact.md
docs/reference/decision_points/cvss/subsequent_integrity_impact.md
docs/reference/decision_points/cvss/target_distribution.md
docs/reference/decision_points/cvss/user_interaction.md
docs/reference/decision_points/cvss/value_density.md
docs/reference/decision_points/cvss/vulnerability_response_effort.md
docs/ssvc-calc/CISA-Coordinator.json
docs/ssvc-calc/Coordinator-Publish.json
docs/ssvc-calc/Coordinator-Triage.json
docs/ssvc-calc/Deployer.json
docs/ssvc-calc/README.md
docs/ssvc-calc/SSVC_Computed.schema.json
docs/ssvc-calc/SSVC_Provision.schema.json
docs/ssvc-calc/Supplier.json
docs/ssvc-calc/cmu-logo.png
docs/ssvc-calc/css.css
docs/ssvc-calc/findex.html
docs/ssvc-calc/icons8-copy-60.png
docs/ssvc-calc/icons8-copy-link-48-blue.png
docs/ssvc-calc/icons8-copy-link-48.png
docs/ssvc-calc/index.md
docs/ssvc-calc/main.css
docs/ssvc-calc/moon_icon.png
docs/ssvc-calc/old_index.html
docs/ssvc-calc/sample-ssvc.txt
docs/ssvc-calc/ssvc-calc.html
docs/ssvc-calc/ssvc.js
docs/ssvc-calc/ssvc_object_registry.json
docs/ssvc-calc/ungraph.js
docs/ssvc-explorer/findex.html
docs/ssvc-explorer/index.md
docs/ssvc-explorer/simple.js
docs/stylesheets/extra.css
docs/topics/asset_management.md
docs/topics/cvss_full_tree.md
docs/topics/decision_points_as_bricks.md
docs/topics/decision_trees.md
docs/topics/enumerating_decisions.md
docs/topics/enumerating_stakeholders.md
docs/topics/evaluation_of_draft_trees.md
docs/topics/formalization_options.md
docs/topics/future_work.md
docs/topics/index.md
docs/topics/information_sources.md
docs/topics/items_with_same_priority.md
docs/topics/limitations.md
docs/topics/related_systems.md
docs/topics/representing_information.md
docs/topics/risk_tolerance_and_priority.md
docs/topics/scope.md
docs/topics/ssvc-human-scale-bottleneck.md
docs/topics/state_of_practice.md
docs/topics/vulnerability_management_decisions.md
docs/topics/worked_example.md
docs/tutorials/other_resources.md
docs/tutorials/ssvc_overview.md
docs/tutorials/starting_points.md
obsolete/Makefile
obsolete/README.md
obsolete/SSVC_csv-to-latex.py
obsolete/emoji-replacements.sed
obsolete/enumerate-coord-publish-options.sh
obsolete/enumerate-coord-triage-options.sh
obsolete/enumerate-deployer-options.sh
obsolete/enumerate-supplier-options.sh
obsolete/pandoc_html_pdf.yaml
obsolete/pdf-styling.yaml
obsolete/ssvc_v2.py
overrides/partials/copyright.html
pdfs/2018_019_001_538372.pdf
pdfs/2019_019_001_636391.pdf
pdfs/2021_019_001_653461.pdf
pdfs/LICENSE
pdfs/ssvc_2_1_draft.pdf
pdfs/weis20-final6.pdf
src/LICENSE
src/README.md
src/ssvc/__init__.py
src/ssvc/_mixins.py
src/ssvc/csv_analyzer.py
src/ssvc/doc_helpers.py
src/ssvc/doctools.py
src/ssvc/examples.py
src/ssvc/md_gen.py
src/ssvc/namespaces.py
src/ssvc/policy_generator.py
src/ssvc/registry_demo.py
src/ssvc/selection.py
src/ssvc/api/README.md
src/ssvc/api/__init__.py
src/ssvc/api/helpers.py
src/ssvc/api/main.py
src/ssvc/api/v1/__init__.py
src/ssvc/api/v1/response_models/__init__.py
src/ssvc/api/v1/response_models/_type_defs.py
src/ssvc/api/v1/routers/__init__.py
src/ssvc/api/v1/routers/decision_point.py
src/ssvc/api/v1/routers/decision_points.py
src/ssvc/api/v1/routers/decision_table.py
src/ssvc/api/v1/routers/decision_tables.py
src/ssvc/api/v1/routers/examples.py
src/ssvc/api/v1/routers/keys.py
src/ssvc/api/v1/routers/namespaces.py
src/ssvc/api/v1/routers/objects.py
src/ssvc/api/v1/routers/types.py
src/ssvc/api/v1/routers/v1_router.py
src/ssvc/api/v1/routers/versions.py
src/ssvc/decision_points/__init__.py
src/ssvc/decision_points/base.py
src/ssvc/decision_points/helpers.py
src/ssvc/decision_points/basic/__init__.py
src/ssvc/decision_points/basic/base.py
src/ssvc/decision_points/basic/near_boundary.py
src/ssvc/decision_points/basic/probability/__init__.py
src/ssvc/decision_points/basic/probability/cis_wep.py
src/ssvc/decision_points/basic/probability/five_equal.py
src/ssvc/decision_points/basic/probability/five_weighted.py
src/ssvc/decision_points/basic/probability/two_equal.py
src/ssvc/decision_points/basic/quantiles/__init__.py
src/ssvc/decision_points/basic/quantiles/median.py
src/ssvc/decision_points/basic/quantiles/quartiles.py
src/ssvc/decision_points/basic/quantiles/quintiles.py
src/ssvc/decision_points/cisa/__init__.py
src/ssvc/decision_points/cisa/base.py
src/ssvc/decision_points/cisa/in_kev.py
src/ssvc/decision_points/cisa/mission_prevalence.py
src/ssvc/decision_points/cisa/publicly_exposed.py
src/ssvc/decision_points/cvss/__init__.py
src/ssvc/decision_points/cvss/_not_defined.py
src/ssvc/decision_points/cvss/attack_complexity.py
src/ssvc/decision_points/cvss/attack_requirements.py
src/ssvc/decision_points/cvss/attack_vector.py
src/ssvc/decision_points/cvss/authentication.py
src/ssvc/decision_points/cvss/availability_impact.py
src/ssvc/decision_points/cvss/availability_requirement.py
src/ssvc/decision_points/cvss/base.py
src/ssvc/decision_points/cvss/collateral_damage_potential.py
src/ssvc/decision_points/cvss/confidentiality_impact.py
src/ssvc/decision_points/cvss/confidentiality_requirement.py
src/ssvc/decision_points/cvss/equivalence_set_1.py
src/ssvc/decision_points/cvss/equivalence_set_2.py
src/ssvc/decision_points/cvss/equivalence_set_3.py
src/ssvc/decision_points/cvss/equivalence_set_4.py
src/ssvc/decision_points/cvss/equivalence_set_5.py
src/ssvc/decision_points/cvss/equivalence_set_6.py
src/ssvc/decision_points/cvss/exploit_maturity.py
src/ssvc/decision_points/cvss/helpers.py
src/ssvc/decision_points/cvss/impact_bias.py
src/ssvc/decision_points/cvss/integrity_impact.py
src/ssvc/decision_points/cvss/integrity_requirement.py
src/ssvc/decision_points/cvss/privileges_required.py
src/ssvc/decision_points/cvss/qualitative_severity.py
src/ssvc/decision_points/cvss/remediation_level.py
src/ssvc/decision_points/cvss/report_confidence.py
src/ssvc/decision_points/cvss/scope.py
src/ssvc/decision_points/cvss/subsequent_availability_impact.py
src/ssvc/decision_points/cvss/subsequent_confidentiality_impact.py
src/ssvc/decision_points/cvss/subsequent_integrity_impact.py
src/ssvc/decision_points/cvss/target_distribution.py
src/ssvc/decision_points/cvss/user_interaction.py
src/ssvc/decision_points/cvss/modified/__init__.py
src/ssvc/decision_points/cvss/modified/modified_subsequent_availability_impact.py
src/ssvc/decision_points/cvss/modified/modified_subsequent_integrity_impact.py
src/ssvc/decision_points/cvss/supplemental/__init__.py
src/ssvc/decision_points/cvss/supplemental/automatable.py
src/ssvc/decision_points/cvss/supplemental/provider_urgency.py
src/ssvc/decision_points/cvss/supplemental/recovery.py
src/ssvc/decision_points/cvss/supplemental/safety.py
src/ssvc/decision_points/cvss/supplemental/value_density.py
src/ssvc/decision_points/cvss/supplemental/vulnerability_response_effort.py
src/ssvc/decision_points/example/__init__.py
src/ssvc/decision_points/example/base.py
src/ssvc/decision_points/example/humidity.py
src/ssvc/decision_points/example/weather.py
src/ssvc/decision_points/nist/__init__.py
src/ssvc/decision_points/nist/base.py
src/ssvc/decision_points/nist/sp800_30_r1_g.py
src/ssvc/decision_points/ssvc/__init__.py
src/ssvc/decision_points/ssvc/automatable.py
src/ssvc/decision_points/ssvc/base.py
src/ssvc/decision_points/ssvc/critical_software.py
src/ssvc/decision_points/ssvc/exploitation.py
src/ssvc/decision_points/ssvc/high_value_asset.py
src/ssvc/decision_points/ssvc/human_impact.py
src/ssvc/decision_points/ssvc/mission_impact.py
src/ssvc/decision_points/ssvc/public_safety_impact.py
src/ssvc/decision_points/ssvc/public_value_added.py
src/ssvc/decision_points/ssvc/report_credibility.py
src/ssvc/decision_points/ssvc/report_public.py
src/ssvc/decision_points/ssvc/safety_impact.py
src/ssvc/decision_points/ssvc/supplier_cardinality.py
src/ssvc/decision_points/ssvc/supplier_contacted.py
src/ssvc/decision_points/ssvc/supplier_engagement.py
src/ssvc/decision_points/ssvc/supplier_involvement.py
src/ssvc/decision_points/ssvc/system_exposure.py
src/ssvc/decision_points/ssvc/technical_impact.py
src/ssvc/decision_points/ssvc/utility.py
src/ssvc/decision_points/ssvc/value_density.py
src/ssvc/decision_tables/__init__.py
src/ssvc/decision_tables/base.py
src/ssvc/decision_tables/helpers.py
src/ssvc/decision_tables/cisa/__init__.py
src/ssvc/decision_tables/cisa/bod_2604_dt.py
src/ssvc/decision_tables/cisa/cisa_coordinate_dt.py
src/ssvc/decision_tables/cvss/__init__.py
src/ssvc/decision_tables/cvss/equivalence_set_five.py
src/ssvc/decision_tables/cvss/equivalence_set_four.py
src/ssvc/decision_tables/cvss/equivalence_set_one.py
src/ssvc/decision_tables/cvss/equivalence_set_six.py
src/ssvc/decision_tables/cvss/equivalence_set_three.py
src/ssvc/decision_tables/cvss/equivalence_set_two.py
src/ssvc/decision_tables/cvss/qualitative_severity.py
src/ssvc/decision_tables/example/__init__.py
src/ssvc/decision_tables/example/base.py
src/ssvc/decision_tables/example/epss_percentile.py
src/ssvc/decision_tables/example/epss_quartile.py
src/ssvc/decision_tables/example/to_play.py
src/ssvc/decision_tables/ssvc/__init__.py
src/ssvc/decision_tables/ssvc/coord_pub_dt.py
src/ssvc/decision_tables/ssvc/coord_triage.py
src/ssvc/decision_tables/ssvc/deployer_dt.py
src/ssvc/decision_tables/ssvc/human_impact.py
src/ssvc/decision_tables/ssvc/public_safety_impact.py
src/ssvc/decision_tables/ssvc/supplier_dt.py
src/ssvc/decision_tables/ssvc/utility.py
src/ssvc/dp_groups/__init__.py
src/ssvc/dp_groups/base.py
src/ssvc/dp_groups/cvss/__init__.py
src/ssvc/dp_groups/cvss/collections.py
src/ssvc/dp_groups/ssvc/__init__.py
src/ssvc/dp_groups/ssvc/collections.py
src/ssvc/dp_groups/ssvc/coordinator_publication.py
src/ssvc/dp_groups/ssvc/coordinator_triage.py
src/ssvc/dp_groups/ssvc/deployer.py
src/ssvc/dp_groups/ssvc/supplier.py
src/ssvc/outcomes/__init__.py
src/ssvc/outcomes/basic/__init__.py
src/ssvc/outcomes/basic/ike.py
src/ssvc/outcomes/basic/lmh.py
src/ssvc/outcomes/basic/mscw.py
src/ssvc/outcomes/basic/value_complexity.py
src/ssvc/outcomes/basic/yn.py
src/ssvc/outcomes/cisa/__init__.py
src/ssvc/outcomes/cisa/bod2604.py
src/ssvc/outcomes/cisa/scoring.py
src/ssvc/outcomes/cvss/__init__.py
src/ssvc/outcomes/cvss/lmhc.py
src/ssvc/outcomes/ssvc/__init__.py
src/ssvc/outcomes/ssvc/coordinate.py
src/ssvc/outcomes/ssvc/dsoi.py
src/ssvc/outcomes/ssvc/publish.py
src/ssvc/outcomes/x_com_yahooinc/__init__.py
src/ssvc/outcomes/x_com_yahooinc/paranoids.py
src/ssvc/registry/__init__.py
src/ssvc/registry/base.py
src/ssvc/registry/events.py
src/ssvc/utils/__init__.py
src/ssvc/utils/defaults.py
src/ssvc/utils/field_specs.py
src/ssvc/utils/importer.py
src/ssvc/utils/misc.py
src/ssvc/utils/namespace_patterns.py
src/ssvc/utils/patterns.py
src/ssvc/utils/schema.py
src/ssvc/utils/ssvc_namespace_pattern.abnf
src/ssvc/utils/toposort.py
src/test/__init__.py
src/test/test_csv_analyzer.py
src/test/test_doc_helpers.py
src/test/test_doctools.py
src/test/test_dp_groups.py
src/test/test_mixins.py
src/test/test_namespaces.py
src/test/test_namespaces_pattern.py
src/test/test_policy_generator.py
src/test/test_schema.py
src/test/test_selections.py
src/test/api/__init__.py
src/test/api/test_helpers.py
src/test/api/test_main.py
src/test/api/response_models/__init__.py
src/test/api/routers/__init__.py
src/test/api/routers/test_decision_point.py
src/test/api/routers/test_decision_points.py
src/test/api/routers/test_decision_table.py
src/test/api/routers/test_decision_tables.py
src/test/api/routers/test_examples.py
src/test/api/routers/test_keys.py
src/test/api/routers/test_namespaces.py
src/test/api/routers/test_objects.py
src/test/api/routers/test_types.py
src/test/api/routers/test_versions.py
src/test/decision_points/__init__.py
src/test/decision_points/test_cvss_helpers.py
src/test/decision_points/test_dp_base.py
src/test/decision_points/test_dp_helpers.py
src/test/decision_tables/__init__.py
src/test/decision_tables/test_base.py
src/test/decision_tables/cvss/__init__.py
src/test/decision_tables/cvss/_v4expected.py
src/test/decision_tables/cvss/test_cvss_qsr4.py
src/test/decision_tables/cvss/test_eq1.py
src/test/decision_tables/cvss/test_eq2.py
src/test/decision_tables/cvss/test_eq3.py
src/test/decision_tables/cvss/test_eq4.py
src/test/decision_tables/cvss/test_eq5.py
src/test/decision_tables/cvss/test_eq6.py
src/test/decision_tables/ssvc/__init__.py
src/test/decision_tables/ssvc/test_coord_triage.py
src/test/decision_tables/ssvc/test_human_impact.py
src/test/dp_groups/__init__.py
src/test/dp_groups/test_dp_groups.py
src/test/outcomes/__init__.py
src/test/outcomes/test_outcomes.py
src/test/registry/__init__.py
src/test/registry/test_base.py
src/test/utils/__init__.py
src/test/utils/test_toposort.py