cvss support. todo enforcement late in SDLC