# SSVC Guides Vulnerability Prioritization

The SSVC Vulnerability Prioritization Guide, associated with CASRAI, describes a risk-based approach for prioritizing vulnerability remediation. It is operational guidance, not legislation: it creates no government-wide procurement mandate, appropriation, contract authorization, or compliance deadline. Federal contractors and research institutions can use it to inform remediation priorities without treating it as a new binding requirement.

- Procurement and security teams may use SSVC’s risk-based approach to help prioritize vulnerability remediation across their environments.
- The guide does not create new contract requirements or a compliance deadline; organizations should distinguish its recommendations from binding agency or contract-specific obligations.

**Jurisdictions:** federal
**Industries:** Information Technology
**Topics:** Cybersecurity
**Published:** November 08, 2026

### Government Entities
- Cybersecurity and Infrastructure Security Agency (CISA)

### Sources
- [SSVC Vulnerability Prioritization Guide — CASRAI](https://casrai.org/guides/ssvc) - CASRAI