A study out of Germany has highlighted shortcomings in the CVSS system and the way security vulnerabilities are assessed and scored
New metrics for Operational Technology exposure include whether the "consequences of the vulnerability meet definition of IEC 61508 consequence categories of "marginal," "critical," or "catastrophic."