Which CVSS metric is most influenced by an organization’s security controls and network environment?

Which CVSS metric is most influenced by an organization’s security controls and network environment?

• A. Base Metric
• B. Environmental Metric
• C. Temporal Metric
• D. Remediation

Answer: (B)

Environmental metrics capture how your specific security controls and network setup change the real impact of a vulnerability. They let you tailor the score to reflect how important confidentiality, integrity, and availability are in your organization and how your controls alter exploitability and impact. For example, if your network is well segmented and protected by strong access controls, the environmental adjustments can lower the practical severity. If your organization requires high confidentiality and data protection, security requirements for CIA can raise the environmental score when those protections are breached. This is why the environmental metric is the one that best reflects organization-specific controls and network context. The base metrics describe the vulnerability itself, independent of any environment. Temporal metrics deal with how exploitability and exploit information change over time. The option labeled as remediation is part of temporal considerations (Remediation Level) and does not capture environmental context in the same way.

Environmental metrics capture how your specific security controls and network setup change the real impact of a vulnerability. They let you tailor the score to reflect how important confidentiality, integrity, and availability are in your organization and how your controls alter exploitability and impact. For example, if your network is well segmented and protected by strong access controls, the environmental adjustments can lower the practical severity. If your organization requires high confidentiality and data protection, security requirements for CIA can raise the environmental score when those protections are breached. This is why the environmental metric is the one that best reflects organization-specific controls and network context.

The base metrics describe the vulnerability itself, independent of any environment. Temporal metrics deal with how exploitability and exploit information change over time. The option labeled as remediation is part of temporal considerations (Remediation Level) and does not capture environmental context in the same way.