The Common Vulnerability Scoring System (CVSS) v3.1 uses three metric groups to calculate overall scores:
Base,Temporal, andEnvironmental.
* Base (E):Mandatory metrics assessing exploitability (e.g., attack vector) and impact (confidentiality, integrity, availability).
* Temporal (A):Optional metrics reflecting the current state of the vulnerability (e.g., exploit availability, remediation level).
* Environmental (F):Optional metrics tailoring the score to the organization's context (e.g., security requirements).
* B, C, D (Availability, Integrity, Confidentiality):These are subcomponents of the Base Impact metrics, not standalone groups.
* G (Impact):A categorywithin Base, not a group.
* H (Attack vector):A single Base metric, not a group.
Reference:CompTIA SecurityX CAS-005 Domain 1: Risk Management - Vulnerability Assessment and Prioritization.

The requirements demand detailed asset tracking and inventory management. Let's analyze:
A). SBoM (Software Bill of Materials):Tracks software components, not hardware or network topology.
B). CASB (Cloud Access Security Broker):Secures cloud apps but doesn't map physical switches or OS counts.
C). GRC(Governance, Risk, and Compliance):Focuses on risk management, not detailed asset tracking.
Reference:CompTIA SecurityX (CAS-005) objectives, Domain 4: Governance, Risk, and Compliance, covering asset management.