Check the license for each dataset before you republish it. CISA distributes KEV with a CC0 1.0 license file. FIRST's EPSS overview page did not state usage terms when fetched. OSV does not state one license for the whole database, because each source sets its own. This is not legal advice; confirm with your counsel.
What each source said on 19 October 2026
| Dataset | What the author found | What to do |
|---|---|---|
| KEV | A license file stating the data is distributed under Creative Commons 0 1.0, with a note that third party links are bound by their own policies | Reuse is permitted by that text; credit CISA anyway |
| EPSS | The overview page described free and open access but stated no usage or citation terms | Look for terms on FIRST's data pages, and credit FIRST and the EPSS model |
| OSV | Each source sets its own license. Examples listed include CC-BY 4.0, CC0 1.0 and Apache 2.0 | Check the source of each record you reuse |
The KEV license text also says that using the data does not authorize use of the CISA logo or DHS seal, and should not be read as an endorsement. Do not display those marks next to your chart.
Attribution line you can adapt
Even where no attribution is required, naming the source helps readers verify. Use the form:
Data: CISA KEV catalog (CC0 1.0), release 2026.10.16, fetched 19 October 2026.
For OSV, name the source database and its license for the records you reproduced, for example the GitHub Advisory Database for advisories originating there. For more on OSV licensing, see can you reuse OSV advisory data.
Steps before you republish a table
- Decide what you will publish: aggregates and counts, or rows copied verbatim. Counts you computed are your own work product, though you should still name the source.
- Find the license for each dataset, and for each source inside OSV.
- Check any conditions: attribution, share alike, or no endorsement.
- Do not copy text from linked third party pages. The KEV license file warns that those are bound by their own terms.
- Record the license and the date you checked it in your manifest. See freeze a dataset.
- If in doubt, link to the source rather than copying.
Common mistakes
- Assuming "free to download" means "free to republish".
- Treating one OSV license as covering all records.
- Copying advisory prose from a vendor page linked in the KEV notes.
- Using an agency logo to look official.
- Forgetting that licenses can change; note the date you checked.
What this post is not
It is a checklist of what the author read, not a legal opinion. Licenses depend on jurisdiction and use. If you plan to build a commercial product on the data, have a lawyer read the actual text.
A worked example: three outputs, three decisions
Suppose you are preparing a post with three kinds of output.
Output one is a chart of KEV entries per year, computed from the feed. You are republishing counts you computed from a dataset distributed with a CC0 1.0 license file. Credit CISA and name the release anyway, because it helps readers verify. Do not add the CISA logo.
Output two is a table of EPSS scores for twenty CVEs, copied from the daily file. The overview page described free and open access but, in the author's fetch, did not state usage or citation terms. Look at the data and API pages for terms, credit FIRST and the model version, and if you cannot find terms, consider publishing the CVE IDs and linking to the source rather than copying a large block of rows.
Output three is a table of advisory summaries from OSV records. Each record comes from a source with its own license, such as CC-BY 4.0 for one database, CC0 1.0 for another and Apache 2.0 for a malicious package list, according to OSV's documentation. Record which source each row came from, and follow the license of each.
Three levels of reuse
| Level | Example | Lowest friction |
|---|---|---|
| Counts and charts you computed | Entries per year | Name the source and snapshot |
| Short excerpts | A handful of rows | Attribute, follow the license |
| Redistributing raw files | A mirror of the feed | Read the license in full |
The more of the original you copy, the more the license matters.
Where the checklist usually fails
- Copying prose from a linked vendor page. KEV's license file says third party links are bound by their own policies.
- Treating OSV as one license.
- Assuming a file named "open" means any use is fine.
- Not recording when you checked.
- Using an agency mark to suggest endorsement. The KEV license text says use of the data does not authorize use of the CISA logo or DHS seal.
Record it
Add a line to your manifest for each dataset: the license name, the URL of the license text, the date you read it and who read it. When you republish, the line lets a reviewer confirm quickly. It also gives you a trail if terms change later. For the manifest itself, see freeze a dataset. And, as before, this is a checklist of what the author read, not legal advice.
Try it yourself
Click through it at your own pace, or open it full screen. Open the inventory and look at how each component carries its own source and version, then think about how each dataset you use carries its own license.
Quick check
Do I need permission to publish counts I computed from KEV?
The KEV license file states CC0 terms. Check the text yourself and consult counsel for your situation. Naming the source is good practice regardless.
Is EPSS data free to use?
FIRST describes it as freely and openly available. Look for specific terms on its data pages before redistributing the raw files.
If I only quote a few rows, do I still need to credit the source?
It is good practice and often required by the license. Name the dataset, release and fetch date.
Sources
- CISA KEV license file, https://www.cisa.gov/sites/default/files/licenses/kev/license.txt (fetched 19 October 2026).
- FIRST, EPSS overview, https://www.first.org/epss/ (fetched 19 October 2026).
- OSV data documentation, https://google.github.io/osv.dev/data/ (fetched 19 October 2026).
Last reviewed: 19 October 2026.
