Describe the solution you'd like

CISA has developed a National Cyber Incident Scoring System. It's a numerical function, but its spec contains a number of ordered categorical lists that could be useful to include in the SSVC vocabulary.

Additional context

This could help us expand applicability of SSVC beyond pure vulnerability response and increase its ability to model vulnerability response in the face of adversarial activity as expressed in incident data.