Who maintains the CVSS scoring system?

Who maintains the CVSS scoring system?

• A. NIST
• B. Forum of Incident Response & Security Teams (FIRST)
• C. ISO
• D. PCI Security Standards Council

Answer: (B)

CVSS is maintained by the Forum of Incident Response and Security Teams (FIRST). They oversee the CVSS specification, including how scores are calculated and how vector strings are written, across versions. This maintenance keeps the system consistent and up-to-date for comparing vulnerability severities across tools and reports. NIST uses CVSS scores in the National Vulnerability Database and government guidance, but does not own or maintain the CVSS specification. ISO publishes many security standards, but not CVSS. PCI Security Standards Council develops PCI DSS and related guidelines; they reference CVSS as a scoring reference but do not maintain the system itself.

CVSS is maintained by the Forum of Incident Response and Security Teams (FIRST). They oversee the CVSS specification, including how scores are calculated and how vector strings are written, across versions. This maintenance keeps the system consistent and up-to-date for comparing vulnerability severities across tools and reports.

NIST uses CVSS scores in the National Vulnerability Database and government guidance, but does not own or maintain the CVSS specification. ISO publishes many security standards, but not CVSS. PCI Security Standards Council develops PCI DSS and related guidelines; they reference CVSS as a scoring reference but do not maintain the system itself.