Your files stay on your device

# SSVC decision calculator

Walk the CISA Coordinator SSVC decision tree from four answers (exploitation, automatable, technical impact, mission and well-being) and return a Track, Track*, Attend, or Act outcome with the answers recorded as defensible reasoning.
ExploitationIs anyone exploiting it? A KEV listing means active.No evidencePublic PoCActive exploitationKEV countsAutomatableCan the whole chain from recon to exploitation run without human judgment?NoYesTechnical impactHow much control does the exploit take of the component?PartialTotalMission and well-beingHow hard does it hit your mission functions and public safety, health, or money?LowMediumHigh

Answer all four questions
The CISA tree refuses to produce an outcome from a partial record, and so does this page.

The decision data is the CISA Coordinator SSVC decision table v 2.0.3 as published by the CERT Coordination Center, Carnegie Mellon University, under an MIT-style license, and the version stays on this page so audits can match it. This tree answers the coordinator question, what deserves the response schedule, not a severity score; it knows nothing about your actual asset inventory. A KEV listing reads as active exploitation here, but the lookup is yours to make: nothing in this page queries KEV, and the tool works fully offline after load.
Options

## More regex & cron tools

- [CSP evaluator & builder](/web/csp)
- [JSON validator](/json/validator)
[All regex & cron tools](/dev)

Was this tool useful?
YesNo

---

Canonical HTML: https://nutter.tools/dev/ssvc-decision-calculator
Markdown version: https://nutter.tools/dev/ssvc-decision-calculator.md
Plain-text version: https://nutter.tools/dev/ssvc-decision-calculator.txt
Agent index: https://nutter.tools/llms.txt