Vulnerability risk level

Score a finding the way CSC does: CVSS for severity, KEV and EPSS for threat, then exposure and the healthcare impact on patients, health data and care services.

Try:

Finding

CVE or advisory ID

Product / tribe

Short description

Assessed by

Detected on

Severity

CVSS base score (v3.1 or v4.0) from the advisory or scanner.

Threat

Is anyone using it? Check the CISA KEV catalogue, vendor advisory and NCSC-FI alerts.

Exploitation

EPSS probability (next 30 days)

No patch available yet (zero-day)Vendor has not released a fix. Active attack on our products or the Finnish health sectorConfirmed by OpsWatch, NCSC-FI or threat intel.

Exposure

Who can reach the vulnerable component?

Healthcare impact

Patient safety

Data at risk

Service criticality

Compensating controls Effective compensating control in placeFor example WAF rule, segmentation, feature disabled or MFA in front. Lowers the score, never below a guardrail.

Severity –

DetectedDue

Risk picture

Impact →

Likelihood →

Likelihood = threat + exposure. Impact = CVSS + healthcare impact. Guardrails can lift the level above where the dot sits.

Why this level

What happens next

Export this assessment

Remediation SLAs (calendar days)

Severity	Example criteria	Maximum time to remediation	Score

Emergency is set by rule, not by score. Guardrails lift a finding to a minimum level whatever the score: active exploitation on an internet-facing system is at least High (Critical when CVSS ≥ 9.0), and active exploitation or CVSS ≥ 7.0 that can directly harm patients is at least Critical or High. CSC sets the final severity and records the reason; exceptions follow the CISO approval path.