SSVC

SSVC copied to clipboard

Some decision points missing in data/json/ folder

2

**Describe the bug** This may be resolved by automatic generation of decision points json as well as the outcome groups json from #739 , but at this time the following...

sei-vsarvepalli

`namespace` entries should point to a url of a JSON list of decision points in that namespace

1

@tschmidtb51 suggested this in a comment on #703: > I'm currently implementing SSVC in CSAF. My suggestion is to have a registry of namespaces. The registry should contain the `namespace`...

ahouseholder

Make OutcomeGroups interchangeable with DecisionPoints

1

**Is your feature request related to a problem? Please describe.** Our documentation has the concept of [Compound Decision Points](https://vuls.cert.org/SSVC/reference/decision_points/compound_decision_points/). Now that I'm working on a _Decision Table_ class in #592,...

ahouseholder

This is intended to be dealt after #749 is merged. We currently have things in the decision point directories in both the data and python folders organized where the "ssvc"...

ahouseholder

Change "Track *" to "Monitor" in our representation of CISA's tree

3

**Is your feature request related to a problem? Please describe.** CISA's adoption of SSVC resulted in their own customized outcome set that they use internally. However, some of the terminology...

ahouseholder

Consider decision points based on FIPS-199

1

**Is your feature request related to a problem? Please describe.** SSVC has no native decision points to support categorization of systems by security requirement levels. **Describe the solution you'd like**...

ahouseholder

Consider a "Time Since Adversarial Activity" decision point

3

**Is your feature request related to a problem? Please describe.** The Exploitation decision point covers three observable states: None, Public PoC, and Active. However, we have received feedback that time...

ahouseholder

Consider a "Deployment Saturation" decision point

3

**Is your feature request related to a problem? Please describe.** Patch deployment is rarely a one-shot event in a network of any significant size. "Percentage of Systems Patched" is a...

ahouseholder

Consider a "Depth of Defenses" decision point

3

**Is your feature request related to a problem? Please describe.** Some organizations consider the nature of their monitoring and defenses as a factor in their vulnerability management processes. Salient features...

ahouseholder

Replace "policy" terminology

8

**Is your feature request related to a problem? Please describe.** Using the word "policy" to describe the mapping of a combination of decision point values to an outcome set might...

ahouseholder