CVSS (Common Vulnerability Scoring System)

Applies to. The standard's own text names CVSS once, in 11.3.2.1: after a significant change, external scans must be run and any vulnerability scored 4.0 or higher by CVSS resolved. The quarterly external scans under 11.3.2 do not mention the score; they defer to the ASV Program Guide, which applies the same 4.0 threshold. Internal scans under 11.3.1 are judged against the entity's own risk rankings from 6.3.1, not against a CVSS number, and CVSS is one input to those rankings.

Example. A retailer opens a new customer-facing API endpoint, which its change process flags as a significant change. The follow-up external scan reports a finding on the load balancer with a CVSS base score of 5.3. Under 11.3.2.1 that finding must be resolved and a rescan run, even though the retailer's internal ranking would have given it a longer window.

Limits. A CVSS score describes the vulnerability in general, not the entity's exposure to it: it does not know whether the affected port is reachable, whether the component holds account data, or what other controls sit in front of it. That is why 6.3.1 asks for a risk ranking that considers potential impact, and why a high CVSS score can be ranked lower internally with a documented reason, or a low one higher; the exception is external scans, where the ASV threshold stands regardless of the internal ranking. The base score also differs from the temporal and environmental scores, and it is the base score that scan reports and the ASV Program Guide use. CVSS is not a list of vulnerabilities; that is CVE, and the two are usually shown together.