An industry standard that gives each vulnerability a qualitative score of its severity, starting from 0 to 10. There are multiple versions to the scoring system with the most recent being CVSS v3. None: 0, Low: 0.1-3.9, Medium: 4-6.9, High: 7-8.9, Critical: 9-10. This is important in vulnerability management and Cyber Essentials as it indicates a method of prioritisation for patch management.