Exploit Code Maturity: How developed available exploit code is - Remediation Level: What type of fix is available - Report Confidence: How well-validated the vulnerability is