Can Outcome be multiple or multi-selected?

[sei-vsarvepalli]

While SSVC is designed to be stakeholder specific and simple to make decision. Is it possible to conceive sometimes where Outcome as defined to be the output of the decision model to be multiple outcomes. Where outcomes are not mutually exclusive but can be combination of outcomes/actions.

This came up as we considered a Coordinator Publish tree, from the binary decision output, we may choose to have multiple outcomes. In that example we may choose to (1) publish a document, (2) a blog, (3) a proof of concept, (4) a video, (5) a mitigation handbook, (6) mitigation tool or a combination of those. What if the outcomes was also cascading over time, that we increase the publication model to have more than a single output. Escalation of the outcome ? Parallel outcome actions ? Distributed responses ?

[j---]

The cleaner way to handle this is to have a decision for each of 1 through 6, if they have different criteria. So you would have 6 distinct decision trees. In that case, decisions 1, 2, and 6 could be "yes" and 3, 4, and 5 could be "no" (or whatever combination). I suppose it is possible to try to visually merge those trees for communicating when some publication is going to happen. But if it's important to distinguish the different publications, and they are independent of each other, then they should just have their own decision.

If they decisions happen at different times, then there should be an information flow or process diagram that specifies when or in what order each decision is made. We have considered that out of scope for SSVC so far (but have made them to organize the coordinator decisions in the past).