CVSS (Common Vulnerability Scoring System)
CVSS, the Common Vulnerability Scoring System, is the 0 to 10 scale Cyber Essentials uses to define critical and high-risk vulnerabilities. Under v3.3 an update must be installed within 14 days of release if it fixes a vulnerability with a CVSS v3 base score of 7 or above, or one the vendor rates critical, high or not at all.
- Term
- CVSS
- Also known as
- Common Vulnerability Scoring System, CVSS score
- Category
- Devices and software
- Requirement area
- 3. Security Update Management
- Questions
- A6.4AUTO-FAILA6.5AUTO-FAIL
- Reviewed against
- Requirements v3.3
What does the term CVSS mean in Cyber Essentials?
CVSS, the Common Vulnerability Scoring System, is the 0 to 10 scale Cyber Essentials uses to define critical and high-risk vulnerabilities.
For the purposes of the Cyber Essentials scheme, ‘critical’ or ‘high risk’ vulnerabilities are those with a CVSS v3 base score of 7 or above, or are identified by the vendor as 'critical or high risk'.
How does CVSS apply to Cyber Essentials?
In plain terms
CVSS is a severity score for a security flaw, from 0 (harmless) to 10 (as bad as it gets). Vendors and scanners publish it next to each flaw's CVE number. Cyber Essentials draws its line at 7.
What Cyber Essentials asks
The requirements use CVSS to pin down which updates fall under the 14-day rule, in the wording quoted above. An update must be installed within 14 days of release where:
- it fixes vulnerabilities the vendor describes as "critical" or "high risk"
- it addresses vulnerabilities "with a CVSS v3 base score of 7 or above"
- the vendor gives no details of the level of vulnerabilities it fixes
If a vendor uses its own severity terms, the requirements say to use the CVSS definition. If a single update covers several issues and any is critical or high risk, "it must be installed within 14 days." A6.4 (operating systems and firmware) and A6.5 (all other software) ask about this and are automatic fails if answered No.
How to read a score
| CVSS v3 base score | Rating in the CVSS v3.1 specification | Cyber Essentials deadline |
|---|---|---|
| 9.0 to 10.0 | Critical | 14 days from release |
| 7.0 to 8.9 | High | 14 days from release |
| 0.1 to 6.9 | Medium (4.0 to 6.9) or low (0.1 to 3.9) | 14 days only if the vendor calls it critical or high risk; otherwise recommended, not mandatory |
| No score or rating given | Not rated | 14 days from release |
Worked example: Microsoft rates many flaws "Important" rather than "High". The name does not decide it. If the CVSS v3 base score on that flaw is 7.0 or above, the update is due within 14 days.
What an assessor looks for
Cyber Essentials Plus test case 2 applies the same three criteria to the output of an authenticated vulnerability scan and fails any qualifying fix that has been available for more than 14 days.
See the security update management requirements, A6.4 and the CVSS v3.1 specification. Related: CVE, authenticated scan, vulnerability fixes.
Related terms
- CVE (Common Vulnerabilities and Exposures)A CVE is a unique public reference number given to a known security flaw, so vendors, scanners and IT teams can all refer to the same problem.
- Authenticated scanAn authenticated scan is a vulnerability scan that logs in to a device, so it can see exactly which software and updates are installed.
- Vulnerability fixesVulnerability fixes are patches, updates, registry fixes, configuration changes, scripts or any other mechanism approved by the vendor to fix a known vulnerability.
- Device unlockingDevice unlocking is the check, such as a PIN, password, fingerprint or face scan, that a person must pass before they can use a laptop, phone or tablet.
- DevicesDevices, in Cyber Essentials, are all types of hosts, networking equipment, servers, networks and end user devices such as laptops, tablets and smartphones, whether physical or virtual.
- End of support (end of life)End of support is the date after which a vendor stops releasing security fixes for a product, so any new flaws found in it stay open for good.
Frequently asked questions
CVSS, the Common Vulnerability Scoring System, is the 0 to 10 scale Cyber Essentials uses to define critical and high-risk vulnerabilities. The definition follows the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3.
In the 2026 Danzell question set, CVSS comes up at A6.4, A6.5. Read those questions against the definition above so your answers use the term the way the assessor will.
CVSS relates to 3. Security Update Management in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.