# Standards and References - CVE Prioritization with KEV Catalog

## Official CISA Resources
- CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- KEV JSON Feed: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
- BOD 22-01: https://www.cisa.gov/binding-operational-directive-22-01
- CISA SSVC Decision Tree: https://www.cisa.gov/ssvc

## Scoring Systems
- FIRST EPSS API: https://api.first.org/data/v1/epss
- EPSS Model Documentation: https://www.first.org/epss/model
- CVSS v4.0 Specification: https://www.first.org/cvss/specification-document
- NVD API v2.0: https://nvd.nist.gov/developers/vulnerabilities

## KEV Catalog Statistics (2025)
| Metric | Value |
|--------|-------|
| Total CVEs in catalog | 1,484+ |
| Added in 2025 | 245 |
| Year-over-year growth | 20% |
| Ransomware-associated (2025) | 24 |

## Regulatory Requirements for KEV Remediation
- **BOD 22-01**: Federal agencies must remediate KEV CVEs per due dates
- **PCI DSS v4.0**: Prioritize remediation of actively exploited vulns
- **NIST CSF 2.0**: Risk-based vulnerability prioritization
- **ISO 27001:2022 A.8.8**: Technical vulnerability management
