From b2e16446430aa027fe633c035e4964f08a1e6613 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 27 Mar 2026 17:00:24 +0000 Subject: [PATCH 1/6] Initial plan From 9d2aa29d0c0354b6cd4936b3f4dcccdbc600422d Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 27 Mar 2026 17:02:58 +0000 Subject: [PATCH 2/6] Add ADR-0014: use 'decision table' instead of 'decision tree' Agent-Logs-Url: https://github.com/CERTCC/SSVC/sessions/429c6ccb-379d-4ca6-ab3d-14c95415f27c Co-authored-by: sei-renae <190382933+sei-renae@users.noreply.github.com> --- .../0014-use-decision-table-terminology.md | 59 +++++++++++++++++++ docs/adr/index.md | 1 + 2 files changed, 60 insertions(+) create mode 100644 docs/adr/0014-use-decision-table-terminology.md diff --git a/docs/adr/0014-use-decision-table-terminology.md b/docs/adr/0014-use-decision-table-terminology.md new file mode 100644 index 00000000..96a8644e --- /dev/null +++ b/docs/adr/0014-use-decision-table-terminology.md @@ -0,0 +1,59 @@ +--- +status: "accepted" +date: 2025-09-17 +--- +# Use "Decision Table" Instead of "Decision Tree" + +## Context and Problem Statement + +SSVC uses a tabular model to map combinations of decision point values to recommended actions. +Historically, this model was referred to as a "decision tree," which is a common term in everyday usage. +However, "decision tree" has a well-established, conflicting meaning in machine learning and statistics, +where it refers to a supervised learning algorithm that partitions a feature space through recursive +binary splits. Using the same term for both concepts creates confusion, especially for audiences +familiar with data science or machine learning. + +## Decision Drivers + +- Avoid ambiguity with the machine learning and operations research concept of "decision tree" +- Accurately describe the underlying SSVC data structure, which is a table of decision points and outcomes +- Improve clarity in documentation, tooling, and communication with practitioners +- Align terminology with the actual data representations used (CSV and JSON tables) + +## Considered Options + +- Continue using "decision tree" +- Switch to "decision table" +- Use both terms with explicit disambiguation + +## Decision Outcome + +Chosen option: "Switch to 'decision table'", because it accurately describes the tabular structure +used by SSVC and avoids the well-established conflicting meaning of "decision tree" in machine +learning and statistics. + +### Consequences + +- Good, because the terminology now accurately reflects the underlying data model (a table mapping + decision point values to outcomes) +- Good, because it reduces confusion for practitioners familiar with machine learning or operations + research +- Neutral, because some existing documentation, external references, and tooling may still use + "decision tree" — these will be updated incrementally +- Bad, because the change breaks consistency with prior SSVC publications and external references + that use "decision tree" + +### Confirmation + +Documentation, code, and tooling use "decision table" as the primary term for the SSVC model. +References to "decision tree" in the visual/hierarchical sense (i.e., tree diagrams used to +illustrate a decision table) may still appear where appropriate but should be clearly distinguished +from the decision table itself. + +## More Information + +This change was introduced with the [SSVC v2025.9 release](https://github.com/CERTCC/SSVC/releases/tag/v2025.9). + +While some documentation may use tree diagrams to visualize a decision table, the underlying +model is always a decision table. The term "decision tree" in SSVC's prior use was closer +in meaning to a lookup table or truth table than to the machine learning construct. diff --git a/docs/adr/index.md b/docs/adr/index.md index 0571e67f..c1ad5680 100644 --- a/docs/adr/index.md +++ b/docs/adr/index.md @@ -25,6 +25,7 @@ the decision records that have been made. - [0011 - Correspondence between Automatable v2.0.0, Value Density v1.0.0, and CVSS v4](0011-automatable-and-value-density-and-CVSSv4.md) - [0012 - SSVC Namespaces](0012-ssvc-namespaces.md) - [0013 - SSVC Project Versions](0013-ssvc-project-versions.md) +- [0014 - Use "Decision Table" Instead of "Decision Tree"](0014-use-decision-table-terminology.md) ## Rejected Records From c395b3c88e805d9e0c5b7bb949227ef4fbb6f371 Mon Sep 17 00:00:00 2001 From: Renae Metcalf Date: Fri, 27 Mar 2026 14:35:24 -0400 Subject: [PATCH 3/6] Modify copilot's work and markdownlint --- .../0014-use-decision-table-terminology.md | 71 ++++++++++--------- 1 file changed, 39 insertions(+), 32 deletions(-) diff --git a/docs/adr/0014-use-decision-table-terminology.md b/docs/adr/0014-use-decision-table-terminology.md index 96a8644e..0755f91e 100644 --- a/docs/adr/0014-use-decision-table-terminology.md +++ b/docs/adr/0014-use-decision-table-terminology.md @@ -1,59 +1,66 @@ --- status: "accepted" -date: 2025-09-17 +date: 2025-08-26 --- # Use "Decision Table" Instead of "Decision Tree" ## Context and Problem Statement -SSVC uses a tabular model to map combinations of decision point values to recommended actions. -Historically, this model was referred to as a "decision tree," which is a common term in everyday usage. -However, "decision tree" has a well-established, conflicting meaning in machine learning and statistics, -where it refers to a supervised learning algorithm that partitions a feature space through recursive -binary splits. Using the same term for both concepts creates confusion, especially for audiences -familiar with data science or machine learning. +SSVC uses a tabular model to map combinations of decision point values to +recommended actions. Historically, this model was referred to as a "decision +tree" or "decision policy" with both terms being used interchangeably in +documentation and tooling. However, "decision tree" has a well-established, +conflicting meaning in machine learning and statistics, and "decision policy" +has overloaded meanings beyond our intended usage. Using the "decision tree" +for both concepts creates confusion, especially for audiences familiar with data +science or machine learning. ## Decision Drivers -- Avoid ambiguity with the machine learning and operations research concept of "decision tree" -- Accurately describe the underlying SSVC data structure, which is a table of decision points and outcomes -- Improve clarity in documentation, tooling, and communication with practitioners -- Align terminology with the actual data representations used (CSV and JSON tables) +- Avoid ambiguity with the machine learning and operations research concept of + "decision tree" +- Use a less contentious term than "policy" as we are not dictating "capital-P + Policy" +- Accurately describe the underlying SSVC data structure, which is a table of + decision points and outcomes +- Improve clarity in documentation, tooling, and communication with + practitioners +- Align terminology with the actual data representations used (CSV and JSON + tables) ## Considered Options -- Continue using "decision tree" +- Switch to "decision framework" - Switch to "decision table" -- Use both terms with explicit disambiguation ## Decision Outcome -Chosen option: "Switch to 'decision table'", because it accurately describes the tabular structure -used by SSVC and avoids the well-established conflicting meaning of "decision tree" in machine -learning and statistics. +Chosen option: 'Switch to "decision table"' + +### Rationale + +"Decision table"accurately describes the tabular structure used by +SSVC and avoids the well-established conflicting meaning of "decision tree" in +machine learning and statistics. ### Consequences -- Good, because the terminology now accurately reflects the underlying data model (a table mapping - decision point values to outcomes) -- Good, because it reduces confusion for practitioners familiar with machine learning or operations - research -- Neutral, because some existing documentation, external references, and tooling may still use - "decision tree" — these will be updated incrementally -- Bad, because the change breaks consistency with prior SSVC publications and external references - that use "decision tree" +- Good, because the terminology now accurately reflects the underlying data + model (a table mapping decision point values to outcomes) +- Good, because it reduces confusion for practitioners familiar with machine + learning +- Bad, because some existing documentation, external references, and tooling may + still use "decision tree" — these will be updated incrementally +- Bad, because the change breaks consistency with prior SSVC publications and + external references that use "decision tree" ### Confirmation -Documentation, code, and tooling use "decision table" as the primary term for the SSVC model. -References to "decision tree" in the visual/hierarchical sense (i.e., tree diagrams used to -illustrate a decision table) may still appear where appropriate but should be clearly distinguished -from the decision table itself. +Documentation, code, and tooling use "decision table" as the primary term for +the SSVC model. References to "decision tree" in the visual/hierarchical sense +(i.e., tree diagrams used to illustrate a decision table) may still appear where +appropriate but should be clearly distinguished from the decision table itself. ## More Information This change was introduced with the [SSVC v2025.9 release](https://github.com/CERTCC/SSVC/releases/tag/v2025.9). - -While some documentation may use tree diagrams to visualize a decision table, the underlying -model is always a decision table. The term "decision tree" in SSVC's prior use was closer -in meaning to a lookup table or truth table than to the machine learning construct. From 507d1ea464137557059cdf0e04b85fb23a95ac6a Mon Sep 17 00:00:00 2001 From: "Allen D. Householder" Date: Thu, 2 Apr 2026 15:56:53 -0400 Subject: [PATCH 4/6] Edits for clarity Refining the wording in places for accuracy & clarity. --- .../0014-use-decision-table-terminology.md | 34 ++++++++++++------- 1 file changed, 22 insertions(+), 12 deletions(-) diff --git a/docs/adr/0014-use-decision-table-terminology.md b/docs/adr/0014-use-decision-table-terminology.md index 0755f91e..826b4b9d 100644 --- a/docs/adr/0014-use-decision-table-terminology.md +++ b/docs/adr/0014-use-decision-table-terminology.md @@ -9,11 +9,14 @@ date: 2025-08-26 SSVC uses a tabular model to map combinations of decision point values to recommended actions. Historically, this model was referred to as a "decision tree" or "decision policy" with both terms being used interchangeably in -documentation and tooling. However, "decision tree" has a well-established, -conflicting meaning in machine learning and statistics, and "decision policy" -has overloaded meanings beyond our intended usage. Using the "decision tree" -for both concepts creates confusion, especially for audiences familiar with data -science or machine learning. +documentation and tooling. While our use of "decision tree" was consistent with +usage in the context of Operations Research +(Wikipedia:[Decision tree](https://en.wikipedia.org/wiki/Decision_tree)), +it caused confusion with the related-yet-different concept from Machine Learning +(Wikipedia: [Decision tree learning](https://en.wikipedia.org/wiki/Decision_tree_learning)). +Furthermore, the term "decision policy" has overloaded meanings beyond our +intended usage. We want to avoid confusion on both fronts, therefore we need a +new term. ## Decision Drivers @@ -22,7 +25,7 @@ science or machine learning. - Use a less contentious term than "policy" as we are not dictating "capital-P Policy" - Accurately describe the underlying SSVC data structure, which is a table of - decision points and outcomes + decision point value combinations and outcomes - Improve clarity in documentation, tooling, and communication with practitioners - Align terminology with the actual data representations used (CSV and JSON @@ -30,19 +33,24 @@ science or machine learning. ## Considered Options -- Switch to "decision framework" -- Switch to "decision table" +- Switch to *decision framework* +- Switch to *decision table* +- Switch to *decision model* ## Decision Outcome -Chosen option: 'Switch to "decision table"' +Chosen option: "Switch to *decision table*" ### Rationale -"Decision table"accurately describes the tabular structure used by +"Decision table" accurately describes the tabular structure used by SSVC and avoids the well-established conflicting meaning of "decision tree" in machine learning and statistics. +We may use *decision model* for the more generic class of things to which a +*decision table* belongs, but *decision table* is specific enough to be clear +exactly what our intended meaning is. + ### Consequences - Good, because the terminology now accurately reflects the underlying data @@ -57,10 +65,12 @@ machine learning and statistics. ### Confirmation Documentation, code, and tooling use "decision table" as the primary term for -the SSVC model. References to "decision tree" in the visual/hierarchical sense +an SSVC decision model. References to "decision tree" in the visual/hierarchical sense (i.e., tree diagrams used to illustrate a decision table) may still appear where appropriate but should be clearly distinguished from the decision table itself. ## More Information -This change was introduced with the [SSVC v2025.9 release](https://github.com/CERTCC/SSVC/releases/tag/v2025.9). +- This change was introduced with the [SSVC v2025.9 release](https://github.com/CERTCC/SSVC/releases/tag/v2025.9). +- Wikipedia's [Decision table](https://en.wikipedia.org/wiki/Decision_table) page aligns with the concept that +we are trying to capture. From e405ce3764c9760a17cde31b7ee22b22960cab8f Mon Sep 17 00:00:00 2001 From: "Allen D. Householder" Date: Thu, 2 Apr 2026 16:02:46 -0400 Subject: [PATCH 5/6] Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --- docs/adr/0014-use-decision-table-terminology.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/adr/0014-use-decision-table-terminology.md b/docs/adr/0014-use-decision-table-terminology.md index 826b4b9d..8e787b34 100644 --- a/docs/adr/0014-use-decision-table-terminology.md +++ b/docs/adr/0014-use-decision-table-terminology.md @@ -11,7 +11,7 @@ recommended actions. Historically, this model was referred to as a "decision tree" or "decision policy" with both terms being used interchangeably in documentation and tooling. While our use of "decision tree" was consistent with usage in the context of Operations Research -(Wikipedia:[Decision tree](https://en.wikipedia.org/wiki/Decision_tree)), +(Wikipedia: [Decision tree](https://en.wikipedia.org/wiki/Decision_tree)), it caused confusion with the related-yet-different concept from Machine Learning (Wikipedia: [Decision tree learning](https://en.wikipedia.org/wiki/Decision_tree_learning)). Furthermore, the term "decision policy" has overloaded meanings beyond our @@ -39,7 +39,7 @@ new term. ## Decision Outcome -Chosen option: "Switch to *decision table*" +Chosen option: "Switch to decision table" ### Rationale @@ -48,8 +48,8 @@ SSVC and avoids the well-established conflicting meaning of "decision tree" in machine learning and statistics. We may use *decision model* for the more generic class of things to which a -*decision table* belongs, but *decision table* is specific enough to be clear -exactly what our intended meaning is. +*decision table* belongs, but *decision table* is specific enough to make it +clear exactly what our intended meaning is. ### Consequences @@ -72,5 +72,5 @@ appropriate but should be clearly distinguished from the decision table itself. ## More Information - This change was introduced with the [SSVC v2025.9 release](https://github.com/CERTCC/SSVC/releases/tag/v2025.9). -- Wikipedia's [Decision table](https://en.wikipedia.org/wiki/Decision_table) page aligns with the concept that -we are trying to capture. +- Wikipedia's [Decision table](https://en.wikipedia.org/wiki/Decision_table) page aligns with the concept that + we are trying to capture. From 25b68d8436f566b5f431a381192b834494dd3ad9 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 3 Apr 2026 17:58:10 +0000 Subject: [PATCH 6/6] Remove emphasis from Considered Options list items in ADR-0014 Agent-Logs-Url: https://github.com/CERTCC/SSVC/sessions/369c5b33-588e-4864-aa55-9163cc333e44 Co-authored-by: sei-renae <190382933+sei-renae@users.noreply.github.com> --- docs/adr/0014-use-decision-table-terminology.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/adr/0014-use-decision-table-terminology.md b/docs/adr/0014-use-decision-table-terminology.md index 8e787b34..358fdc20 100644 --- a/docs/adr/0014-use-decision-table-terminology.md +++ b/docs/adr/0014-use-decision-table-terminology.md @@ -33,9 +33,9 @@ new term. ## Considered Options -- Switch to *decision framework* -- Switch to *decision table* -- Switch to *decision model* +- Switch to decision framework +- Switch to decision table +- Switch to decision model ## Decision Outcome