Vulnerability Assessment & Security Standards

**CVSS v4.0** (released November 2023, current standard): - Score range: 0.0–10.0 - Severity ratings: None (0.0), Low (0.1–3.9), Medium (4.0–6.9), High (7.0–8.9), Critical (9.0–10.0) - Four metric groups: Base, Threat, Environmental, Supplemental - **Red flag**: Any unpatched CVE with CVSS ≥ 7.0 older than 30 days - **Red flag**: No CVE tracking process or vulnerability scanning cadence defined - **Red flag**: Using CVSS v2 or v3 without acknowledging v4.0 availability