CycloneDX VEX

Vulnerability Exploitability eXchange: PURL, hash integrity, version specificity, supplier attribution.


Short name	CDX VEX
Region	International
Country or scope	International
Sector	Supply Chain
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers CDX VEX

Scan requirements: 7, all decided by a scan.
Controls: the scan requirements below, plus 6 controls from Safeguard's control catalog for CDX VEX.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 24: 2 written for CDX VEX and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 7 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`VEX-CDX-PURL` Correlatable Component Identifiers	VEX statements reference affected components by identifier, so components must carry PURLs for statements to be matched deterministically (CISA Minimum Requirements for VEX - product identifiers; CycloneDX analysis referencing)	Scan
`VEX-CDX-VER` Version-Scoped Statements	Exploitability status is asserted per product version, so nearly every component must declare its version for VEX status to apply (CISA Minimum Requirements for VEX - product version; CycloneDX component.version)	Scan
`VEX-CDX-SPEC` Unambiguous Version Values	Vague versions (ranges, latest, wildcards) make a VEX statement's scope undecidable, so component versions must be exact (CycloneDX spec - component version semantics)	Scan
`VEX-CDX-HASH` Artefact-Level Assurance	Hashes bind a VEX assertion to the exact artefact analysed, preventing status being applied to a tampered or different build (CycloneDX spec - component.hashes)	Scan
`VEX-CDX-FMT` Machine-Readable BOM	VEX is designed to be processed automatically alongside the SBOM, which must therefore be in a standard machine-readable format such as CycloneDX or SPDX (CISA Minimum Requirements for VEX - machine readability)	Scan
`VEX-CDX-DOC` Statement Metadata	A VEX document must identify itself and carry timestamps so consumers can order and supersede statements; the paired SBOM needs the same document identity and creation time (CISA Minimum Requirements for VEX - VEX metadata)	Scan
`VEX-CDX-AUTH` Statement Author	VEX requires an identified author for each statement, so the document creator (tool/organisation) must be recorded (CISA Minimum Requirements for VEX - VEX author)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`VEX-1`	Publish VEX Statements for All Disclosed Vulnerabilities
`VEX-2`	Justify Not-Affected VEX Status with Evidence
`VEX-3`	Track Affected Vulnerabilities Through Remediation
`VEX-4`	Automate VEX Generation in CI/CD
`VEX-5`	Version and Sign VEX Documents
`VEX-6`	Distribute VEX to Software Consumers

Policy templates

Written for CDX VEX:

Vulnerability Exploitability Exchange (VEX) Management Policy
Customer Security Advisory and VEX Notification Policy

And 22 from the standard set, adapted to CDX VEX.