A CSAF provider must pick one distribution style: directory based (year folders, index.txt, changes.csv, directory listings) or ROLIE based (a feed, a service document and a category document). Directory based is simpler to build by hand. ROLIE is a feed standard that makes polling and discovery easier for tools.
What each option requires
CSAF 2.0 section 7.2.2 says a provider must satisfy requirements 11 to 14 if it uses the directory layout, or requirements 15 to 17 if it uses ROLIE. Requirements 8 to 10 (discovery) apply either way.
| Item | Directory based | ROLIE based |
|---|---|---|
| Requirements | 11 to 14 | 15 to 17 |
| Structure | One folder per year, named for the year of the initial release date | A ROLIE feed per TLP level, plus a service document and a category document |
| Index | index.txt lists all filenames | The feed lists the documents |
| Change tracking | changes.csv with filename and current release date, latest first | Feed entries carry update information |
| Navigation | Directory listing enabled for manual browsing | Feed and service documents for tools |
How the directory style works
Requirement 11 puts each document in a folder named for the year in its initial release date field. Requirement 12 says index.txt lists every CSAF filename in those folders. Requirement 13 says changes.csv holds the filename and the current release date for each document, with no heading, sorted latest first. Requirement 14 says directory listing shall be enabled. A static web server and a small script can maintain all of this.
How ROLIE works
The standard describes ROLIE, the Resource-Oriented Lightweight Information Exchange, as a standard to ease discovery of security content, built on the Atom publishing format and protocol. All documents with the same TLP level must be listed in a ROLIE feed. A service document and a category document complete the set. The standard also says that if a ROLIE feed exists, hash and signature files must be listed in it.
Choosing
- Small advisory volume, static hosting, no feed expertise: directory style.
- Many advisories, customers with automated polling tools, or a PSIRT platform that already emits feeds: ROLIE.
- Unsure: start with directory style. The year folders and index files are easy to generate from the same source later if you add a feed.
Whichever you choose, keep the provider metadata file pointing at the right place. A separate post explains how customers discover your CSAF advisories.
Quick check
Can we offer both styles?
The standard's provider role requires one of the two groups. Offering both is not forbidden in the text we read, but it doubles maintenance, so most teams pick one.
Does the layout change the advisory content?
No. It only changes how documents are organised and listed.
Safeguard's compliance and evidence automation can help you keep dated records of what you publish, and the free scan covers your dependency list.
Sources
Last reviewed: 19 October 2026.
