# Stakeholder-Specific Vulnerability Categorization **Acronym:** SSVC **Entity class:** Vulnerability-prioritization method ## Definition **Stakeholder-Specific Vulnerability Categorization (SSVC)** is a decision framework for prioritizing vulnerability response according to stakeholder context. It complements severity scoring by connecting vulnerability characteristics and exploitation conditions to an action-oriented decision. In June 2026, [[wiki/National Vulnerability Database|NVD]] added computed SSVC data to its APIs and feeds. That change strengthens the machine-readable progression from naming a vulnerability to deciding how urgently a particular defender should act. ## Relationships - **data platform:** [[wiki/National Vulnerability Database|National Vulnerability Database]]. - **severity complement:** [[wiki/Common Vulnerability Scoring System|Common Vulnerability Scoring System]]. - **operational exploitation:** [[wiki/Known Exploited Vulnerabilities Catalog|Known Exploited Vulnerabilities Catalog]]. - **continuous architecture:** [[wiki/Continuous Vulnerability Intelligence|Continuous Vulnerability Intelligence]]. ## Sources / Provenance - Cybersecurity and Infrastructure Security Agency, [Stakeholder-Specific Vulnerability Categorization](https://www.cisa.gov/stakeholder-specific-vulnerability-categorization-ssvc), accessed 2026-09-23. - National Institute of Standards and Technology, [NVD June 17, 2026 deployment update](https://www.nist.gov/itl/nvd), accessed 2026-09-23. **As of:** 2026-09-23