Suppliers' Tree - Can the safety question be answered?

[laurie-tyz]

I spent time with Siemens and learned that THEY believe they cannot determine an answer to the question regarding "Safety" 90% of the time. (Mission & Well-being) Therefore every time they use SSVC, they end up with the answer - TRACK .

Siemens realizes TRACK is not the answer -- but they are stuck with what would work better. Ideas?

[ahouseholder]

(Converted to a discussion since there's not a concrete task yet.)

So TRACK is only part of the Coordinator Triage tree. The Coordinator Triage tree is geared toward organizations like CERT/CC, JPCERT/CC, NCSC-NL etc. who have a fairly broad societal-level view. Hence the PublicSafetyImact attribute.

The Supplier tree has a Human Impact decision point (formerly described as Mission & Well Being Impact) in which safety is a factor, but I'm confused as to how you get to a track decision from that tree because that's not one of the possible outputs.

I would have thought that Siemens would be using the Supplier tree instead of the Coordinator Triage tree (and I might be misunderstanding their operational scope and constituency too), but the problem description seems to be a blend of these two so it's not clear what to recommend.

[j---]

@laurie-tyz , what are the chances that the Siemens folks can be brought onto this thread so can discuss what the issue is?

Also, in general, all the SSVC decision trees in the main doc are recommendations. If a stakeholder can't answer a question, they should remove it from the tree and decide on actions/decisions from what they can answer.

[ahouseholder]

Noting location of relevant text: Most of /doc/md_src_files/055_decision-points_2.md

[j---]

I think we can close this discussion because I spun out the details into #259 , #260 , and #261