Mell, P.
and Scarfone, K.
(2010),
The Common Configuration Scoring System (CCSS): Metrics for Software Security Configuration Vulnerabilities, NIST Interagency/Internal Report (NISTIR), National Institute of Standards and Technology, Gaithersburg, MD, [online], https://doi.org/10.6028/NIST.IR.7502
(Accessed July 24, 2025)
Official websites use .gov
A .gov website belongs to an official government organization in the United States.
Secure .gov websites use HTTPS
A lock (
) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.
The Common Configuration Scoring System (CCSS): Metrics for Software Security Configuration Vulnerabilities
Published
Author(s)
, Karen Scarfone
Abstract
The Common Configuration Scoring System (CCSS) is a set of measures of the severity of software security configuration issues. CCSS is derived from the Common Vulnerability Scoring System (CVSS), which was developed to measure the severity of vulnerabilities due to software flaws. CCSS can assist organizations in making sound decisions as to how security configuration issues should be addressed and can provide data to be used in quantitative assessments of the overall security posture of a system. This report defines proposed measures for CCSS and equations to be used to combine the measures into severity scores for each configuration issue. The report also provides several examples of how CCSS measures and scores would be determined for a diverse set of security configuration issues.Citation
NIST Interagency/Internal Report (NISTIR) - 7502
Report Number
7502
NIST Pub Series
Pub Type
NIST Pubs
Download Paper
Keywords
security configuration, security measurement, vulnerability measurement, vulnerability scoring
Citation
Issues
If you have any questions about this publication or are having problems accessing it, please contact [email protected].
Created December 27, 2010, Updated June 2, 2021