One of our goals in the Microsoft Security Response Center (MSRC) is to be more transparent with security researchers and our customers on the criteria we use for determining when we intend to address a reported vulnerability through a security update. Our belief is that improving transparency on this topic helps provide clarity on how we assess risk, sets expectations for the types of vulnerabilities that we intend to service, and facilitates constructive dialogue as the threat landscape evolves over time. Ultimately, we believe this enables us all to work together to better protect Microsoft’s customers.
Toward this end, we released a draft version of the security servicing criteria for Windows in June, 2018. We received some great feedback from the research community and the broader security industry that we used to improve the clarity of this criteria. Today, we are happy to announce the publication of the first version of the security servicing criteria for Windows. We expect this to be a living document that evolves over time and we look forward to continuing the dialogue with the community on this topic.
Microsoft Security Servicing Criteria for Windows Microsoft Vulnerability Severity Classification for Windows
Please reach out to us at switech@microsoft.com or @msftsecresponse on twitter to continue the discussion.
We’d like to acknowledge all of our partner teams from across Microsoft who helped to create and improve the clarity of this criteria.
Nate Warfield - Microsoft Security Response Center (MSRC)