Vulnerability risk rating

Based on the OWASP Risk Rating Methodology: Risk = Likelihood × Impact. Rate each factor 0–9, and the severity comes from the OWASP matrix, customised for healthcare and mapped to the CSC remediation SLAs.

Step 1 · Identify the risk

CVE or advisory ID

Product / tribe

Short description

Assessed by

Detected on

CVSS base score (reference only – used for the cross-check)

OWASP: rate the worst-case threat agent and the worst-case impact.

Step 4 · Threat intelligence overrides

Facts that outrank the estimate above.

Exploited in the wild (CISA KEV or vendor confirmed)Likelihood is set to at least High (6.0). No patch available yet (zero-day)Together with active exploitation, this triggers Emergency. Active attack on our products or the Finnish health sectorConfirmed by OpsWatch, NCSC-FI or threat intel. Triggers Emergency.

Step 7 · Impact basis

OWASP uses business impact when you have good business information, otherwise technical impact.

Business impact Technical impact Worst case of both

Severity–

Total risk0of 81 (L × I)

Likelihood0

Impact0

DetectedDue

OWASP risk matrix

Impact →

Likelihood →

Each factor group is the average of its 0–9 ratings. 0 to under 3 is Low, 3 to under 6 Medium, 6 to 9 High.

Driving factors and checks

What happens next

Export this assessment

Severity levels and remediation SLAs (calendar days)

Severity	Example criteria	Maximum time to remediation	OWASP result (likelihood × impact)

Method: OWASP Risk Rating Methodology, repeatable method (factor averages, equal weights). CSC customisations allowed by OWASP step 6: a patient safety business-impact factor that sets the minimum impact; a “none” option for privacy; KEV sets likelihood to at least High; Emergency is a rule-based overlay above OWASP Critical; OWASP “Note” maps to Low. CSC sets the final severity and records the reason.