# Vulnerability Prioritization Framework
## SSVC Decision Tree (CISA)
Exploitation status → Automatable → Technical Impact → Mission Prevalence → Decision
- **Act** — immediate remediation (actively exploited, automatable, total impact)
- **Attend** — prioritize within normal cycle
- **Track*** — monitor, remediate in standard cycle
- **Track** — remediate with normal updates

## SLA by Risk
| Severity | CVSS | EPSS | SLA |
|----------|------|------|-----|
| Critical | 9.0+ | >0.5 | 24-48 hours |
| High | 7.0-8.9 | >0.1 | 7 days |
| Medium | 4.0-6.9 | <0.1 | 30 days |
| Low | 0.1-3.9 | <0.01 | 90 days |
