CSAF 2.0 defines roles by the requirements a party meets. A publisher meets requirements 1 to 4, a provider adds requirements 5 to 7 plus discovery and distribution, and a trusted provider adds integrity, signatures and a public key. Each role builds on the one before it.
What CSAF is
The OASIS standard describes the Common Security Advisory Framework as a language to exchange security advisories formulated in JSON. A vendor uses it to publish machine-readable advisories that customers' tools can read. Section 7 of the standard defines distribution requirements and then groups them into roles.
The three roles
| Role | Requirements it must satisfy (section 7.1) | In plain terms |
|---|---|---|
| Publisher | 1 to 4 | Valid documents, proper filenames, served over TLS, public TLP:WHITE documents freely accessible. Distributes only its own documents |
| Provider | Publisher, plus 5 to 7, plus one of 8 to 10, plus 11 to 14 or 15 to 17 | Adds protection for restricted documents, a provider metadata file, a discovery method, and an organised layout or ROLIE feed |
| Trusted provider | Provider, plus 18 to 20 | Adds hash files, OpenPGP signatures and a public key |
The standard also defines lister and aggregator roles for parties that list or mirror other publishers' documents. A normal software vendor does not need those.
Which role to target
Start with publisher. Valid documents, correct filenames and TLS are a modest first step, and the standard requires that you distribute only CSAF documents on your own behalf at this level.
Move to provider when customers want to find your advisories automatically. The extra requirements, such as a provider metadata file and a discoverable location, are what let a customer's tool locate and poll your advisories without manual links.
Aim for trusted provider when buyers ask how they can verify that an advisory has not been altered. Requirements 18 to 20 add hash files and signatures for each document and a public key.
Practical notes
- Requirement 3 says documents must not be downloadable from a location that fails to encrypt transport when crossing organisational boundaries.
- Requirement 6 forbids redirects for the document locations.
- Requirements 8 to 10 give three discovery options, and a provider must meet at least one.
- A provider chooses between the directory layout (requirements 11 to 14) and the ROLIE layout (requirements 15 to 17).
For discovery details see how customers find your CSAF advisories.
Quick check
Is a CSAF role a certification?
No. The roles describe which listed requirements a distributing party satisfies. They are a conformance profile, not an audit result.
Do we need to be a trusted provider to publish VEX?
No. The CSAF VEX profile concerns the document content. The roles concern how you distribute documents.
Safeguard's compliance and evidence automation can help you keep records of what you published and when, and the free scan covers your own dependencies.
Sources
Last reviewed: 19 October 2026.
