@@ -9,11 +9,14 @@ date: 2025-08-26
99SSVC uses a tabular model to map combinations of decision point values to
1010recommended actions. Historically, this model was referred to as a "decision
1111tree" or "decision policy" with both terms being used interchangeably in
12- documentation and tooling. However, "decision tree" has a well-established,
13- conflicting meaning in machine learning and statistics, and "decision policy"
14- has overloaded meanings beyond our intended usage. Using the "decision tree"
15- for both concepts creates confusion, especially for audiences familiar with data
16- science or machine learning.
12+ documentation and tooling. While our use of "decision tree" was consistent with
13+ usage in the context of Operations Research
14+ (Wikipedia: [ Decision tree] ( https://en.wikipedia.org/wiki/Decision_tree ) ),
15+ it caused confusion with the related-yet-different concept from Machine Learning
16+ (Wikipedia: [ Decision tree learning] ( https://en.wikipedia.org/wiki/Decision_tree_learning ) ).
17+ Furthermore, the term "decision policy" has overloaded meanings beyond our
18+ intended usage. We want to avoid confusion on both fronts, therefore we need a
19+ new term.
1720
1821## Decision Drivers
1922
@@ -22,27 +25,32 @@ science or machine learning.
2225- Use a less contentious term than "policy" as we are not dictating "capital-P
2326 Policy"
2427- Accurately describe the underlying SSVC data structure, which is a table of
25- decision points and outcomes
28+ decision point value combinations and outcomes
2629- Improve clarity in documentation, tooling, and communication with
2730 practitioners
2831- Align terminology with the actual data representations used (CSV and JSON
2932 tables)
3033
3134## Considered Options
3235
33- - Switch to "decision framework"
34- - Switch to "decision table"
36+ - Switch to decision framework
37+ - Switch to decision table
38+ - Switch to decision model
3539
3640## Decision Outcome
3741
38- Chosen option: ' Switch to " decision table"'
42+ Chosen option: " Switch to decision table"
3943
4044### Rationale
4145
42- "Decision table"accurately describes the tabular structure used by
46+ "Decision table" accurately describes the tabular structure used by
4347SSVC and avoids the well-established conflicting meaning of "decision tree" in
4448machine learning and statistics.
4549
50+ We may use * decision model* for the more generic class of things to which a
51+ * decision table* belongs, but * decision table* is specific enough to make it
52+ clear exactly what our intended meaning is.
53+
4654### Consequences
4755
4856- Good, because the terminology now accurately reflects the underlying data
@@ -57,10 +65,12 @@ machine learning and statistics.
5765### Confirmation
5866
5967Documentation, code, and tooling use "decision table" as the primary term for
60- the SSVC model. References to "decision tree" in the visual/hierarchical sense
68+ an SSVC decision model. References to "decision tree" in the visual/hierarchical sense
6169(i.e., tree diagrams used to illustrate a decision table) may still appear where
6270appropriate but should be clearly distinguished from the decision table itself.
6371
6472## More Information
6573
66- This change was introduced with the [ SSVC v2025.9 release] ( https://github.com/CERTCC/SSVC/releases/tag/v2025.9 ) .
74+ - This change was introduced with the [ SSVC v2025.9 release] ( https://github.com/CERTCC/SSVC/releases/tag/v2025.9 ) .
75+ - Wikipedia's [ Decision table] ( https://en.wikipedia.org/wiki/Decision_table ) page aligns with the concept that
76+ we are trying to capture.
0 commit comments