Anthropic-Cybersecurity-Skills/skills/performing-cve-prioritization-with-kev-catalog/references/standards.md

Standards and References - CVE Prioritization with KEV Catalog

Official CISA Resources

• CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• KEV JSON Feed: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
• BOD 22-01: https://www.cisa.gov/binding-operational-directive-22-01
• CISA SSVC Decision Tree: https://www.cisa.gov/ssvc

Scoring Systems

• FIRST EPSS API: https://api.first.org/data/v1/epss
• EPSS Model Documentation: https://www.first.org/epss/model
• CVSS v4.0 Specification: https://www.first.org/cvss/specification-document
• NVD API v2.0: https://nvd.nist.gov/developers/vulnerabilities

KEV Catalog Statistics (2025)

Metric	Value
Total CVEs in catalog	1,484+
Added in 2025	245
Year-over-year growth	20%
Ransomware-associated (2025)	24

Regulatory Requirements for KEV Remediation

• BOD 22-01: Federal agencies must remediate KEV CVEs per due dates
• PCI DSS v4.0: Prioritize remediation of actively exploited vulns
• NIST CSF 2.0: Risk-based vulnerability prioritization
• ISO 27001:2022 A.8.8: Technical vulnerability management