What is CVSS and how is it used in reports?

• A. Common Vulnerability Scoring System; provides standardized risk scores to prioritize remediation.
• B. Centralized Vulnerability Scanning System; aggregates scan results.
• C. Cryptographic Vulnerability Scoring Schema; rates encryption flaws.
• D. Client Vulnerability Scheduling System; coordinates remediation tasks.

Answer: (A)

CVSS provides a standardized way to rate how severe a vulnerability is, giving a numeric score that reflects its risk. In reports, these scores create a common, comparable measure so teams can prioritize remediation and communicate risk clearly to both technical and non-technical stakeholders. The score typically ranges from 0.0 to 10.0 and is built from metrics that capture how easy it is to exploit, what impact it would have on confidentiality, integrity, and availability, and other contextual factors. This consistent language helps triage vulnerabilities across systems and justify where to focus fixes and resources. The other options describe systems or schemas that aren’t about a universal scoring framework for vulnerability risk, so they don’t fit CVSS’s purpose.