cwe.mitre.org/cwraf/). The mechanisms in CWSS and CWRAF minimize this difficulty by letting organizations model
their own business impact considerations into a risk-scoring mechanism.
CWSS provides the mechanism for scoring software’s weaknesses in a consistent, flexible, open manner while
considering the context and reflecting the weaknesses’ impacts against that context. It aims to provide a consistent