Base: This group contains the fundamental qualities of a vulnerability and includes metrics such as attack complexity and exploitability. Temporal: This group contains qualities that change over time like patch level, availability of exploit code, and remediation level. Environmental: This group contains qualities that are specific to an organization's environment such as business value and asset criticality.