Keep these ten answers handy. An SBOM is a formal record of components and their relationships. VEX states whether a product is affected by a vulnerability. CSAF is a JSON advisory format. CISA says its VEX document mandates nothing, so match your answers to the contract.
The answers
What is an SBOM?
The NTIA report describes it as a formal record containing the details and supply chain relationships of various components used in building software.
What fields does it carry at minimum?
Supplier name, component name, version, other unique identifiers, dependency relationship, author of SBOM data and timestamp.
What is VEX?
CISA's document says VEX indicates the status of a software product or component with respect to a vulnerability, commonly to say it is or is not affected.
What statuses exist?
Four: not affected, affected, fixed and under investigation.
Why would a product be not affected?
Five justification labels exist: component not present, vulnerable code not present, vulnerable code not in execute path, vulnerable code cannot be controlled by adversary, and inline mitigations already exist.
Who writes VEX?
The supplier or a third party, according to CISA. The author is responsible for the content.
Do you need an SBOM to publish VEX?
No. CISA says VEX is designed to integrate with SBOMs but does not require them.
What is CSAF?
The OASIS standard calls it a language to exchange security advisories formulated in JSON. A VEX document in CSAF uses the category csaf_vex.
How often should the SBOM change?
NTIA says a new build or release needs a new SBOM, and corrections warrant a revised one.
Is this a legal requirement?
The CISA VEX document says it does not impose or mandate compliance. Requirements come from contracts or the rules that apply to your sector, so check those directly.
A one line summary for buyers
We provide an SBOM per release in a machine-readable format, we publish VEX status for findings that matter, and we correct files when we find errors.
Keep the answers current
These sources are dated 2021 and 2023, and practices change. Before using them in a formal response, check that no newer guidance has replaced them.
Try it yourself
Open the demo to see the difference between a vulnerable component and an exploitable one. That is the idea behind most VEX questions.
Click through it at your own pace, or open it full screen.
Quick check
Do all buyers want the same format?
No. Ask which format their tools read before generating.
Should sales promise VEX for everything?
No. Offer status for findings that matter and describe your process.
Safeguard's SBOM and dependency scanning and reachability analysis support these answers with evidence, and the free scan lets you try it on your own code.
Sources
- The Minimum Elements For a Software Bill of Materials (NTIA, 2021)
- Minimum Requirements for Vulnerability Exploitability eXchange (VEX), CISA, April 2023
- Common Security Advisory Framework Version 2.0 (OASIS Standard)
Last reviewed: 19 October 2026.
