VEX Readiness

SBOM readiness for Vulnerability Exploitability eXchange: PURL coverage, version, hash, namespace.


Short name	VEX
Region	Internal
Country or scope	Internal
Sector	Supply Chain
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers VEX

Scan requirements: 7, all decided by a scan.
Controls: the scan requirements below, plus 7 controls from Safeguard's control catalog for VEX.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 25: 3 written for VEX and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 7 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`VEX-PURL` Machine-Resolvable Product Identifiers	VEX statements must identify affected products with identifiers that tooling can resolve, requiring PURLs on SBOM components (CISA Minimum Requirements for VEX: product identification)	Scan
`VEX-IDENT` Fallback Identifiability	Components lacking a PURL must at least carry another standard identifier (e.g. CPE) so vulnerability status can still be asserted against them (CISA Minimum Requirements for VEX: product identification)	Scan
`VEX-VER` Version-Level Status Granularity	Exploitability status differs by version, so VEX-ready SBOM components must each record an exact version (CISA Minimum Requirements for VEX: product version identification)	Scan
`VEX-DOCID` Linkable Document Identity	VEX documents reference the SBOM they qualify, so the SBOM must have a unique document identifier and timestamp to be linkable and supersedable (CISA Minimum Requirements for VEX: document metadata; CycloneDX/CSAF linking)	Scan
`VEX-FMT` Machine-Readable SBOM Base	VEX exchange is machine-to-machine, so the underlying SBOM must be in a machine-readable standard format (CISA Minimum Requirements for VEX: machine readability)	Scan
`VEX-HASH` Artifact Binding via Hashes	Binding a not-affected assertion to the exact shipped artifact is strongest when components carry hashes distinguishing rebuilds and patched variants (VEX use-case guidance; CycloneDX hashes)	Scan
`VEX-GRAPH` Transitive Status Propagation	Determining whether a vulnerable subcomponent affects the top-level product requires the SBOM's dependency relationships (VEX status justification, e.g. component_not_present / not in execute path)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`VEX-01`	PURL Coverage for VEX Correlation
`VEX-02`	Hash Presence for Impact Assessment
`VEX-03`	Version Specificity for VEX Matching
`VEX-04`	Namespace for Ecosystem Identification
`VEX-05`	VEX Document Ingestion Pipeline
`VEX-06`	Internal VEX Authoring Capability
`VEX-07`	VEX Statement Expiry and Re-Evaluation

Policy templates

Written for VEX:

VEX Readiness and SBOM Quality Prerequisites Policy
VEX Document Lifecycle and Authoring Policy
VEX-Based Vulnerability Suppression Governance Policy

And 22 from the standard set, adapted to VEX.