CISA's Minimum Requirements for Vulnerability Exploitability eXchange (VEX), published in April 2023, define the data elements a VEX document should carry, independent of file format. They are guidance, not a mandate. CISA says the document does not represent official CISA policy and does not impose compliance.
What the document is
It specifies the minimum elements to create a VEX document, and some optional ones. It is format neutral. CISA notes that CSAF, CycloneDX and OpenVEX can contain or be used to generate VEX documents. The elements are described as derived from, but possibly not fully conforming to, existing implementations.
What CISA says about its own status
Worth quoting in spirit: the document was drafted by experts but did not follow a formal standards process, does not necessarily represent consensus, and is expected to change. Elements may be added, removed or changed. The requirements declare version 1.0.0, and implementations should say which version they support.
The required elements
Document level:
- A document ID.
- A document version.
- An author.
- First issued and last updated timestamps.
Statement level:
- A statement version and timestamps.
- At least one product identifier.
- Exactly one vulnerability identifier, plus a description or a reference to one.
- One status: not_affected, affected, fixed or under_investigation.
- For not_affected, a justification or an impact statement.
- For affected, an action statement.
Statement IDs are recommended rather than required.
Authors and scope
VEX can be written by the supplier or a third party. It is designed to integrate with SBOMs, vulnerability databases and advisories, but does not require any of them. A VEX author does not need to list every product, and CISA says VEX does not assume any default status that is not explicitly provided.
Signing and exchange
Documents and statements should be signed, with the author cryptographically tied to the signer. CISA does not specify how or when to exchange VEX, leaving timestamps and versions to support tracking.
What it does not say
- It does not set a required file format.
- It does not define how to specify version ranges or product sets.
- It does not make VEX mandatory for anyone.
- It does not say how a consumer must act on a statement.
Treat claims that "CISA requires VEX" with suspicion. The text says otherwise.
How teams use it in practice
Most teams treat the document as a checklist when choosing or evaluating a VEX tool or supplier file. Take each required element and check whether the file contains it. If the author, version and timestamps are present, and every not_affected statement has a justification or impact statement, the file meets the minimum.
Remember that meeting the minimum says nothing about accuracy. It is a structural test. Accuracy comes from the evidence behind each statement, which is why sampling matters.
Quick check
Does CISA require suppliers to publish VEX?
Not in this document. It states that it does not impose or mandate compliance.
Which formats does it endorse?
It names CSAF, CycloneDX and OpenVEX as able to contain or generate VEX, without requiring any one of them.
Sources
Last reviewed: 19 October 2026.
