Which term is an acronym for a standard used to convey vulnerability severity?

• A. Data-Flow Diagram
• B. CVSS
• C. Cryptoperiod
• D. Cryptography

Answer: (B)

The standard used to convey vulnerability severity is the Common Vulnerability Scoring System, or CVSS. It provides a consistent numeric score and qualitative ratings to express how severe a vulnerability is, helping organizations compare issues and prioritize fixes. CVSS breaks down the assessment into base, temporal, and environmental metrics, with the base score capturing intrinsic severity (how severe the vulnerability is and how easily it can be exploited), and the temporal and environmental scores adjusting that value based on factors like exploit availability and the specific environment. Scores range from 0.0 to 10.0 and map to severities such as None, Low, Medium, High, and Critical, guiding remediation priorities across different systems and advisories. The other terms describe entirely different concepts: a data-flow diagram shows data movement in a system; a cryptoperiod defines how long a cryptographic key remains valid; and cryptography is the broader field of securing communication and data.