VER-EVA-EFA Evaluation Factors
All changes in this version
Title
Evaluation Factors
Control
Providers SHOULD consider at least the following factors when considering the context of the cloud service offering to evaluate detected vulnerabilities:
- **Criticality**: How important are the systems or information that might be impacted by the vulnerability?
- **Reachability**: How might a threat actor reach the vulnerability and how likely is that?
- **Exploitability**: How easy is it for a threat actor to exploit the vulnerability and how likely is that?
- **Detectability**: How easy is it for a threat actor to become aware of the vulnerability and how likely is that?
- **Prevalence**: How much of the cloud service offering is affected by the vulnerability?
- **Privilege**: How much privileged authority or access is granted or can be gained from exploiting the vulnerability?
- **Proximate Vulnerabilities**: How does this vulnerability interact with previously detected vulnerabilities, especially partially or fully mitigated vulnerabilities?
- **Known Threats**: How might already known threats leverage the vulnerability and how likely is that?